Apache Software Foundation Directory Ldap Api vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Apache Software Foundation Directory Ldap Api: 3 record(s), with affected versions and fixes.cpe:2.3:a:apache:directory_ldap_api
CVE-2026-103885
High · 7.5
CWE-400 Oct 2, 2026
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server...
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
CVE-2026-103877
Critical · 9.8
CWE-502 Oct 2, 2026
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
A rogue...
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
CVE-2026-35563
High · 8.5
CWE-297 Jun 1, 2026
Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname
It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP
hostname. While the underlying code validates the certificate chain
against a trusted authority, the absence of endpoint identification
allows a valid certificate issued for an entirely unrelated host to be
improperly accepted. This oversight leaves the connection highly
vulnerable to server impersonation and complete connection compromise.
The
root cause of this vulnerability lies in the incomplete TLS server
identity verification within the LDAP client implementation.
The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store.
The hostname verification has been enforced in the new version of the LDAP API