Apache Apache Directory Ldap API
7 CVEs affecting Apache Apache Directory Ldap API. Latest disclosed: 2026-10-02. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-103877 | Critical | 9.8 | 2026-10-02 | Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSc… |
CVE-2026-35563 | High | 8.5 | 2026-06-01 | It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the… |
CVE-2026-103885 | High | 7.5 | 2026-10-02 | Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core… |
CVE-2026-103880 | High | 7.5 | 2026-10-02 | Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDA… |
CVE-2026-103878 | High | 7.5 | 2026-10-02 | Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has… |
CVE-2026-102731 | High | 7.5 | 2026-10-02 | Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response c… |
CVE-2026-103552 | High | 7.3 | 2026-10-02 | Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the s… |