CVE-2026-103877
published 2026-10-02CVE-2026-103877: Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.57%
46.6th percentile
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_directory_ldap_api | >= 2.1.0 < 2.1.9 | 2.1.9 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization
vendor_redhat·2026-10-02·CVSS 8.1
CVE-2026-103877 [HIGH] CWE-502 org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization
org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization
A flaw was found in Apache Directory LDAP API. This vulnerability allows a rogue or compromised LDAP server, or a network attacker performing a man-in-the-middle (MitM) attack, to execute arbitrary code on the client. During a schema search request, an attacker can return a crafted schema object containing a serialized Java class, triggering unsafe deserialization when processed by the client application.
Package: api-ldap-client-api (Red Hat Fuse 7) - Affected
GHSA
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
ghsa_unreviewed·2026-10-02
CVE-2026-103877 CWE-502 Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE.
This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.
Users are recommended to upgrade to version 2.1.9, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-10-02
Published