PT-2026-45280 · Apache · Apache Directory Ldap Api

Łukasz Kollbek + 1 · Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-35563

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API version 2.1.7

Description The LDAP client implementation fails to verify if the server certificate matches the intended LDAP hostname. Although the certificate chain is validated against a trusted authority, the lack of endpoint identification allows a valid certificate issued for an unrelated host to be accepted. This flaw enables server impersonation and complete connection compromise if an attacker with Man-in-the-Middle (MITM) capabilities presents a certificate trusted by the client's trust store.

Recommendations Update to the new version of the LDAP API where hostname verification is enforced.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2026-35563

Affected Products

Apache Directory Ldap Api

References · 11

• https://ubuntu.com/security/CVE-2026-35563 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35563 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35563 · Security Note
• https://lists.apache.org/thread/5rc2nzqxp1m9wknyf93r8dnp46fhc1nn · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35563 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35563 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35563 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/06/01/2 · Note
• https://t.me/cveNotify/165422 · Telegram Post
• https://openwall.com/lists/oss-security/2026/06/01/2 · Note
• https://twitter.com/oss_security/status/2061637545390186815 · Twitter Post