[<prev] [next>] [day] [month] [year] [list]
Message-ID: <82389c47-777c-b099-b37f-b09e6c63fab2@apache.org>
Date: Sun, 31 May 2026 22:03:27 +0000
From: Emmanuel Lécharny <elecharny@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-35563: Apache Directory LDAP API: LDAP client
implementation does not verify if the server certificate matches the
intended LDAP hostname
Severity: important
Affected versions:
- Apache Directory LDAP API (org.apache.directory.api:api-ldap-client-api) 2.0.0 through 2.1.7
Description:
It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP
hostname. While the underlying code validates the certificate chain
against a trusted authority, the absence of endpoint identification
allows a valid certificate issued for an entirely unrelated host to be
improperly accepted. This oversight leaves the connection highly
vulnerable to server impersonation and complete connection compromise.
The
root cause of this vulnerability lies in the incomplete TLS server
identity verification within the LDAP client implementation.
The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store.
The hostname verification has been enforced in the new version of the LDAP API
Credit:
Rafał Łykowski and Łukasz Kollbek of Qualtrics (finder)
References:
https://directory.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-35563
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
