CVE-2026-35563: CWE-297 Improper Validation of Certificate with Host Mismatch in Apache Software Foundation Apache Directory LDAP API
Apache Directory LDAP API version 2.0.0 contains a vulnerability where the LDAP client does not verify that the server certificate matches the intended LDAP hostname. Although the certificate chain is validated against trusted authorities, the lack of endpoint identification allows acceptance of valid certificates issued for unrelated hosts. This flaw enables potential server impersonation and connection compromise if an attacker can perform a man-in-the-middle attack with a trusted certificate. Hostname verification has been enforced in newer versions of the LDAP API.
AI Analysis
Technical Summary
CVE-2026-35563 is a vulnerability in Apache Directory LDAP API version 2.0.0 where the LDAP client implementation fails to verify that the server's TLS certificate matches the intended LDAP hostname. While the certificate chain validation against trusted authorities is performed, the absence of endpoint identification allows an attacker with MITM capability and a trusted certificate to impersonate the server. This incomplete TLS server identity verification can lead to connection compromise. The issue is addressed by enforcing hostname verification in newer LDAP API versions.
Potential Impact
An attacker with man-in-the-middle capability who can present a certificate trusted by the client's trust store can impersonate the LDAP server, potentially compromising the confidentiality and integrity of the LDAP connection. This can lead to unauthorized access or data interception during LDAP communications.
Mitigation Recommendations
The vulnerability is fixed by enforcing hostname verification in newer versions of the Apache Directory LDAP API. Users should upgrade to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.
CVE-2026-35563: CWE-297 Improper Validation of Certificate with Host Mismatch in Apache Software Foundation Apache Directory LDAP API
Description
Apache Directory LDAP API version 2.0.0 contains a vulnerability where the LDAP client does not verify that the server certificate matches the intended LDAP hostname. Although the certificate chain is validated against trusted authorities, the lack of endpoint identification allows acceptance of valid certificates issued for unrelated hosts. This flaw enables potential server impersonation and connection compromise if an attacker can perform a man-in-the-middle attack with a trusted certificate. Hostname verification has been enforced in newer versions of the LDAP API.
CVSS v4.0
Score 8.8high
Affected software
pkg:maven/org.apache.directory.api/api-ldap-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35563 is a vulnerability in Apache Directory LDAP API version 2.0.0 where the LDAP client implementation fails to verify that the server's TLS certificate matches the intended LDAP hostname. While the certificate chain validation against trusted authorities is performed, the absence of endpoint identification allows an attacker with MITM capability and a trusted certificate to impersonate the server. This incomplete TLS server identity verification can lead to connection compromise. The issue is addressed by enforcing hostname verification in newer LDAP API versions.
Potential Impact
An attacker with man-in-the-middle capability who can present a certificate trusted by the client's trust store can impersonate the LDAP server, potentially compromising the confidentiality and integrity of the LDAP connection. This can lead to unauthorized access or data interception during LDAP communications.
Mitigation Recommendations
The vulnerability is fixed by enforcing hostname verification in newer versions of the Apache Directory LDAP API. Users should upgrade to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-04-03T13:46:12.414Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1d4e79e29bf47b50cd4b6b
Added to database: 06/01/2026, 09:18:49 UTC
Last enriched: 07/08/2026, 13:38:50 UTC
Last updated: 07/25/2026, 08:52:03 UTC
Views: 266
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.