You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@directory.apache.org by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:48:05 UTC

CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

Severity: critical 

Affected versions:

- Apache Directory LDAP API 2.1.0 before 2.1.9

Description:

Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.



A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. 



This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.



Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Credit:

Claude Security (tool)
The Apache Software Foundation (finder)

References:

https://directory.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-103877


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@directory.apache.org
For additional commands, e-mail: users-help@directory.apache.org