Vulnerabilitymedium
CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS
AI summary · grok-4.7Summaries by Vani AI
Apache Directory LDAP API versions before 2.1.9 can leak plaintext responses when StartTLS follows a search.
Emmanuel Lécharny disclosed CVE-2026-103878 in Apache Directory LDAP API. Versions 2.1.0 before 2.1.9 can receive plaintext data if StartTLS begins after a Search request is sent and before the TLS handshake completes. Apache rates the cleartext transmission issue as important. The notice does not report exploitation in the wild.
Key facts
- Affects Apache Directory LDAP API 2.1.0 before 2.1.9.
- StartTLS after a sent Search can return data before the handshake completes.
- Apache rates the cleartext sensitive-information flaw as important.
- The disclosure does not report active exploitation.
- CVEs
- CVE-2026-103878
- Vendors
- Apache
- Products
- Apache Directory LDAP API
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103878 | Cleartext responses during StartTLS in Apache Directory LDAP API | 7.5 | — |
From the original article
Posted by Emmanuel Lécharny on Oct 02 Severity: important Affected versions: - Apache Directory LDAP API 2. 1. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.