Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache Directory LDAP API can run code from malicious schema

CVE-2026-103877 · published 17 days ago
Summary

If a client uses the Apache Directory LDAP API to talk to an LDAP server, a specially crafted response can cause the client to load and execute unwanted Java code, potentially letting an attacker take control. This affects versions 2.1.0 through 2.1.8. Updating the library to version 2.1.9 resolves the risk.

What to do
  • Update apache software foundation apache directory ldap api to version 2.1.9 or later.
Affected software
Ecosystem VendorProductAffected versions
– apache software foundation apache directory ldap api < 2.1.9
Debian:12 debian apache-directory-api All versions
Ubuntu:16.04:LTS canonical apache-directory-api All versions
Original advisory text
Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published2 Oct 2026
Updated17 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-103877 · NVD
CVE-2026-103877 · MITRE
DEBIAN-CVE-2026-103877 · OSV
UBUNTU-CVE-2026-103877 · OSV
Track software like this
Free during beta