Read the docs
TI-2026-27670 Aliases CVE-2026-35563GHSA-85rw-g4f4-jprr

Apache Directory LDAP API: LDAP client implementation does not verify if the server…

Priority LOW 39CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix Fixed org.apache.directory.api:api-ldap-client-api (Maven): 2.1.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Directory LDAP API2.0.0 – 2.1.7—No fix listedCNA
—org.apache.directory.api:api-ldap-client-api (Maven)2.0.0 to before 2.1.82.1.8Patch availableGHSA-85rw-g4f4-jprr
  • Apache Directory LDAP API VendorApache Affected 2.0.0 – 2.1.7 Fixed in — No fix listed CNA
  • org.apache.directory.api:api-ldap-client-api (Maven) Vendor— Affected 2.0.0 to before 2.1.8 Fixed in 2.1.8 Patch available GHSA-85rw-g4f4-jprr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:directory_ldap_api:*:*:*:*:*:*:*:*2.0.0 to before 2.1.7VulnerableApache
  • cpe:2.3:a:apache:directory_ldap_api:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.1.7 Vulnerable ·Apache

Remediation

  • Fix · GHSA-85rw-g4f4-jprr org.apache.directory.api:api-ldap-client-api (Maven) Fixed in 2.1.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35563
  2. 2026-10-03 Alias added: GHSA-85rw-g4f4-jprr
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Advisory 3

Other 2

  • TI-2018-01238 Information disclosure in Apache Directory CVSS 3.0CRITICAL 9.8
  • TI-2015-02878 Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences