CVE-2026-103877: Apache Directory LDAP API deserialization of untrusted data
CVE-2026-103877 is a CWE-502 deserialization weakness in the Apache Directory LDAP API, affecting versions from 2.1.0 before 2.1.9. According to the CNA description, a rogue or compromised LDAP server, or interception before TLS, could return a schema object with a serialized Java class during loadSchema(), which may allow remote code execution. The CNA recommends upgrading to 2.1.9, and the record reports a CVSS 3.1 base score of 9.8 with critical severity.
Overview\n\nCVE-2026-103877 is a deserialization of untrusted data weakness (CWE-502) in the Apache Directory LDAP API, affecting versions from 2.1.0 before 2.1.9. According to the CNA description, the issue is tied to a client calling loadSchema() and receiving a subschema search response that contains a serialized Java class. The record was published on 2026-10-02 by security@apache.org.\n\n## Impact\n\nThe CNA states the issue allows some potential remote code execution. The scenario described involves a rogue or compromised LDAP server, or a man-in-the-middle position before TLS is established. The record gives a CVSS 3.1 base score of 9.8 from the CNA, rated critical, with a vector indicating network attack, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.\n\n## Affected products and versions\n\n- Product: Apache Directory LDAP API\n- Affected range stated in the description: from 2.1.0 before 2.1.9\n- Fixed version stated in the description: 2.1.9\n- The structured affected and fixes fields in the record are empty, so the range above comes only from the description text.\n\n## Exploitation status\n\nThe record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00572 with a percentile of 0.45813, dated 2026-10-13.\n\n## Remediation and mitigation\n\n- Upgrade Apache Directory LDAP API to version 2.1.9, which the description says fixes the issue.\n- Inventory applications and libraries that embed the LDAP API, including transitive dependencies, since they may be affected without direct use.\n- If an immediate upgrade is not possible, restrict the LDAP servers that clients can contact to trusted endpoints and make sure directory connections use TLS correctly.\n- Review where loadSchema() is used in your code and limit connections to directories you control.\n\n## Detection guidance\n\n- Identify deployed versions of the library in software inventories and flag any released before 2.1.9 and after 2.1.0.\n- Monitor, at a high level, for unexpected directory connections to unapproved LDAP endpoints.\n- Review application logs for deserialization errors or unexpected class loading, recognizing that the available information does not define specific indicators of compromise.\n\n## Limitations of the available information\n\n- The record has no structured affected, fixed or CPE data, and no vendor advisory beyond the Apache mailing list thread and the oss-security post.\n- The record status is Deferred, so details may change.\n- The exact exploitation conditions and any required deserialization components are unknown from the sources consulted.\n- Independent verification of the 2.1.9 fix is not stated in the sources consulted.
Frequently asked questions
Which versions of Apache Directory LDAP API are affected by CVE-2026-103877?
According to the description in the record, versions from 2.1.0 before 2.1.9 are affected. The structured affected field is empty, so this range comes only from the text.
What is the recommended fix?
The description recommends upgrading to version 2.1.9, which it states fixes the issue.
Is this CVE known to be exploited in the wild?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.