org.apache.directory.api/api-ldap-client-api vulnerabilities

Latest org.apache.directory.api/api-ldap-client-api CVEs

Newest publication first

1. CVE-2026-103878 Apache Directory LDAP API: Injection of plaintext responses during StartTLS

   Published 2026-10-02

   High·CVSS 7.5

   Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Dir...

2. CVE-2026-35563 Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname

   Published 2026-06-01

   High·CVSS 8.8

   It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allow...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.