Apache Directory Ldap Api (Apache Software Foundation) - vulnerabilities (CVEs)

7 CVEs, 6 in the last 30 days, 2 known versions, newest CVE from 2026-10-02. Vendor: Apache Software Foundation.

CVEs of Apache Directory Ldap Api

• CVE-2026-103885 - CVSS 7.5 (high), 2026-10-02: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core…
• CVE-2026-103877 - CVSS 9.8 (critical), 2026-10-02: Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's…
• CVE-2026-103880 - CVSS 7.5 (high), 2026-10-02: Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP…
• CVE-2026-103878 - CVSS 7.5 (high), 2026-10-02: Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has…
• CVE-2026-103552 - CVSS 7.3 (high), 2026-10-02: Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the…
• CVE-2026-102731 - CVSS 7.5 (high), 2026-10-02: Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response…
• CVE-2026-35563 - CVSS 8.8 (high), 2026-06-01: It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the…