Password hashing can become a denial-of-service primitive when cost parameters are treated as trusted data. CVE-2026-103880 concerns bcrypt verification with excessive stored cost settings. The interesting operational lesson is not that bcrypt is weak—it is that intentionally expensive security controls can become availability risks when attacker-influenced or corrupted parameters are processed without practical bounds. **In practical terms, it is a good time to:** - identify applications and directory components using the affected LDAP API branch for password verification - inspect stored bcrypt parameters for anomalous cost values and establish what values the application legitimately generates - benchmark authentication CPU consumption in a controlled environment using representative and extreme cost settings - alert on sustained CPU saturation in directory or authentication services alongside authentication latency and failure rates Security controls that consume resources by design still need input boundaries. #Authentication #LinuxSecurity #SecurityOperations #OpenSource #CyberResilience https://linuxsecurity.com/news/security-vulnerabilities/apache-directory-ldap-api-vulnerabilities