CVE-2026-103877

Apache Directory LDAP API versions 2.1.0 before 2.1.9 deserialize untrusted data when loading LDAP schema (CWE-502). A rogue or compromised LDAP server, or an attacker who can intercept traffic before TLS, can answer a client's loadSchema() subschema search with a schema object that embeds a serialized Java class. That can lead to remote code execution in the Java process that loads the schema. Java applications and services that use the affected API and call loadSchema() against untrusted or interceptable LDAP servers are affected. No public proof of concept is known, and the issue is not listed in CISA KEV.

What to do: Upgrade Apache Directory LDAP API to 2.1.9 or later. Until then, do not call loadSchema() against untrusted LDAP servers, and require TLS with certificate validation so a network attacker cannot inject schema responses. Inventory Java applications that embed this library and prioritize those that load schema from external directories.