Threat database

A vulnerability in Apache Directory LDAP API versions 1.2.0 up to but not including 1.2.9 allows a malicious peer or man-in-the-middle to trigger excessive memory allocation via a crafted BER-encoded response. This can cause the client JVM to run out of memory (OutOfMemoryError), resulting in denial of service. The issue is fixed in version 1.2.9.

CVE-2026-103878 is a vulnerability in Apache Directory LDAP API versions 2.1.0 up to but not including 2.1.9. It allows sensitive information to be transmitted in cleartext due to insufficient verification of data authenticity during a StartTLS operation initiated after a Search request. This issue is fixed in version 2.1.9.

Apache Directory LDAP API version 2.0.0 contains a vulnerability where the LDAP client does not verify that the server certificate matches the intended LDAP hostname. Although the certificate chain is validated against trusted authorities, the lack of endpoint identification allows acceptance of valid certificates issued for unrelated hosts. This flaw enables potential server impersonation and connection compromise if an attacker can perform a man-in-the-middle attack with a trusted certificate. Hostname verification has been enforced in newer versions of the LDAP API.