Vulnerabilidades do Apache Software Foundation Directory Ldap Api
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apache Software Foundation Directory Ldap Api: 3 registro(s), com versões afetadas e correções.cpe:2.3:a:apache:directory_ldap_api
CVE-2026-103885
Alta · 7.5
CWE-400 02/10/2026
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server...
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
CVE-2026-103877
Crítica · 9.8
CWE-502 02/10/2026
Apache Directory LDAP API desserialização de dados não confiáveis
Vulnerabilidade de Desserialização de Dados Não Confiáveis no Apache Directory LDAP API.\n\nUm servidor LDAP não autorizado/malicioso ou comprometido (ou um MITM antes do TLS) pode responder à pesquisa de subesquema feita por loadSchema() de um cliente com um objeto de esquema que contém uma classe Java serializada, permitindo potencial RCE.\n\nEste problema afeta o Apache Directory LDAP API: da versão 2.1.0 até antes da 2.1.9.\n\nRecomenda-se que os usuários atualizem para a versão 2.1.9, que corrige o problema.
CVE-2026-35563
Alta · 8.5
CWE-297 01/06/2026
Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname
It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP
hostname. While the underlying code validates the certificate chain
against a trusted authority, the absence of endpoint identification
allows a valid certificate issued for an entirely unrelated host to be
improperly accepted. This oversight leaves the connection highly
vulnerable to server impersonation and complete connection compromise.
The
root cause of this vulnerability lies in the incomplete TLS server
identity verification within the LDAP client implementation.
The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store.
The hostname verification has been enforced in the new version of the LDAP API