CVE-2026-103878

Apache Directory LDAP API from 2.1.0 before 2.1.9 can receive sensitive directory data in cleartext when a StartTLS extended operation is started after a Search request has already been sent, before the TLS handshake finishes. Related reporting describes this as injection of plaintext responses during that StartTLS window. An on-path attacker can therefore expose or substitute LDAP data before encryption is in place. Any application that embeds this Java client library and uses that Search-then-StartTLS sequence is affected. No public proof of concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.

What to do: Upgrade Apache Directory LDAP API to 2.1.9 and rebuild or redeploy every application that embeds 2.1.0 through versions before 2.1.9. Review LDAP client flows that issue a Search and then StartTLS, and do not treat directory data as trusted until the TLS handshake has completed.