CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Apache Directory LDAP API before 2.1.9 can deserialize Java from a rogue LDAP schema, enabling potential remote code execution.
Emmanuel Lécharny disclosed CVE-2026-103877, a critical deserialization flaw in Apache Directory LDAP API versions 2.1.0 before 2.1.9. A rogue or compromised LDAP server, or a pre-TLS man-in-the-middle, can answer a client's loadSchema() subschema search with a schema object containing a serialized Java class. That unsafe loading can lead to remote code execution on the client. The advisory does not report observed exploitation.
- Affects Apache Directory LDAP API 2.1.0 before 2.1.9.
- Rogue LDAP server or pre-TLS MITM can supply a serialized Java class in schema data.
- loadSchema() may deserialize that class, with potential remote code execution.
- Vendor rates the deserialization issue critical; no exploitation is reported.
- CVEs
- CVE-2026-103877
- Vendors
- Apache Software Foundation
- Products
- Apache Directory LDAP API
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103877 | Unsafe Java deserialization in Apache Directory LDAP API | 9.8 | — |
From the original article
Posted by Emmanuel Lécharny on Oct 02 Severity: critical Affected versions: - Apache Directory LDAP API 2. 1. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.