82 matches found
CVE-2026-102731
The Apache Directory LDAP API (versions 1.2.0 before 1.2.9 ) is vulnerable to a memory allocation flaw caused by an excessive size value during BER decoding . A malicious peer or Man-in-the-Middle (MITM) actor can send a small BER-encoded response that triggers a large memory allocation before da...
PT-2026-104188
Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description An asymmetric resource consumption issue exists where a LDAP server using the LDAP API may consume 100% of a CPU core indefinitely. This occurs when the server processes...
CVE-2026-103885: Uncontrolled Resource Consumption
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. User...
PT-2026-104186
Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description Sensitive information may be transmitted in cleartext. A StartTLS extended operation initiated after a Search request is sent can result in data being received in plain text...
CVE-2026-103880: Asymmetric Resource Consumption (Amplification)
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...
CVE-2026-102731: Memory Allocation with Excessive Size Value
Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...
CVE-2026-103877: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server or pre-TLS MITM can answer a client's loadSchema subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache...
PT-2026-104187
Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description An asymmetric resource consumption issue exists where storing a password using the bcrypt algorithm with an excessively high cost factor, such as 30, can cause the server CPU t...
CVE-2026-103552: Stack-based Buffer Overflow
Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...
PT-2026-104167
Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...
PT-2026-104168
Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 1.2.0 through 1.2.8 Description An unauthenticated client can trigger a stack overflow in the server's decoder by sending a deeply nested search filter before binding. Approximately 154 instances have been...
CVE-2026-103878: Insufficient Verification of Data Authenticity
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...
PT-2026-104185
Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description An issue exists involving the deserialization of untrusted data. A compromised LDAP server or a man-in-the-middle attacker can respond to a client's loadSchema subschema search...
EUVD-2018-0745
Malware in sbrugna...
PT-2024-41457
Уязвимость функции treatLengthEndState в модуле asn1/ber/src/main/java/org/apache/directory/api/asn1/ber/Asn1Decoder.java Apache Directory LDAP API связана с отсутсвием контроля вводимых пользователем данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ...
Server side request forgery (ssrf)
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...
CVE-2018-1337
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...
CVE-2018-1337: Exposure of Sensitive Information to an Unauthorized Actor
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...
PT-2018-11784
Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions prior to 1.0.2 Description A bug in the setup of the SSL Filter allows another thread to use a connection before the TLS layer is established, potentially leaking information, including credentials sent in a...