Apache Software FoundationCVE-2026-103877

Apache Directory LDAP API: unsafe deserialization

UnratedCVE-2026-103877 · Published Oct 2, 2026

Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache Directory LDAP API Product	>= 2.1.0, < 2.1.9	2.1.9

Details and references

Severity from: no source yet
Weakness: CWE-502

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946550.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946560.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946570.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-946540.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-854760.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: integer overflow Critical9.2Oct 2 CVE-2026-836320.25.0	Critical9.2	0.25.0