main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache…
Priority MEDIUM 41CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods.
Why it matters now
EPSS 0.05729 93rd percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
Not affected: 5 products
- Red Hat Enterprise Linux 7
- Red Hat Fuse 7
- Red Hat JBoss Fuse 6
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6497
- 2026-10-03 Alias added: GHSA-2pwj-47v7-pcxg
References
Advisory 3
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
- [directory-users] 20161029 Security vulnerability in Groovy LDAP API
- http://svn.apache.org/viewvc/directory/sandbox/szoerner/groovyldap/src/main/java/org/apache/directory/groovyldap/LDAP.java?r1=1765362&r2=1765361&pathrev=1765362&view=patch
Sources
- CVE-2016-6497 · CVE Program
- CVE-2016-6497 · NVD
- FIRST EPSS
- GHSA-2pwj-47v7-pcxg · GitHub Advisory Database · CC BY 4.0
- CVE-2016-6497 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences