CLEANSTART-2026-GT33551 Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password

Security vulnerability affects the apache-nifi-registry package. Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password...

ROOT-APP-MAVEN-CVE-2026-41720 CVE-2026-41720 in org.springframework.ldap:spring-ldap-core - Patched by Root

Root has patched CVE-2026-41720 in the org.springframework.ldap:spring-ldap-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38829 CVE-2024-38829 in org.springframework.ldap:spring-ldap-core - Patched by Root

Root has patched CVE-2024-38829 in the org.springframework.ldap:spring-ldap-core package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1789400252 TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.3.RELEASE-tuxcare.1...

PT-2026-98181

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.3.RELEASE-tuxcare.1...

CLSA-2026-1789146534 TuxCare security update for org.springframework.ldap (1 CVE)

TuxCare rebuilt 8 org.springframework.ldap packages to address 1 CVE. Fixed in 2.4.1-tuxcare.2...

CLSA-2026-1782176232 TuxCare security update for org.springframework.ldap (1 CVE)

TuxCare rebuilt 8 org.springframework.ldap packages to address 1 CVE. Fixed in 2.4.4-tuxcare.8...

GHSA-JRV5-8W28-4265 Spring LDAP has Authentication Bypass with Empty Password

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

com.erudika:para-jar (>=1.51.2, <=1.51.4), com.erudika:para-server (>=1.51.2, <=1.54.7) +57 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=4.0.0, <=4.0.3)

org.springframework.ldap:spring-ldap-core MAVEN version =4.0.0, =1.51.2, =1.51.2, =0.2.2, =2.0.0, =2.0.0, =3.2.1, =3.2.1, =3.2.1, =2.5.0, =2.4.0, =2.4.0, =2.5.2 and more Source cves: CVE-2026-41720 Source advisory: OSV:GHSA-JRV5-8W28-4265...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.1.0), com.daioware.security:security (1.0.0.release) +160 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (1.3.2.release)

org.springframework.ldap:spring-ldap-core MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ldap:spring-ldap-core and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.5.2, =0.3.1, =0.2.0, =0.2.0,...

ai.h2o:h2o-orc-parser (>=3.10.0.5, <=3.10.3.6), cc.chensoul.nacos:core-test (2.5.2) +708 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=2.0.0.release, <=2.4.4)

org.springframework.ldap:spring-ldap-core MAVEN version =2.0.0.release, =3.10.0.5, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.567.22 and more Source cves: CVE-2026-41720 Source advisory: OSV:GHSA-JRV5-8W28-4265...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=12.1.0), cc.zzzyu.nacos:default-auth-plugin (3.1.1) +133 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.2.0, <=3.2.16)

org.springframework.ldap:spring-ldap-core MAVEN version =3.2.0, =1.0.0.ee-20260424025040, =0.0.13, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.11.5 and more Source cves: CVE-2026-41720 Source advisory: OSV:GHSA-JRV5-8W28-4265...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=12.1.0), cc.zzzyu.nacos:default-auth-plugin (3.1.1) +133 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.2.0, <=3.2.16)

org.springframework.ldap:spring-ldap-core MAVEN version =3.2.0, =1.0.0.ee-20260424025040, =0.0.13, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.11.5 and more Source cves: CVE-2026-41720 Source advisory: GHSA-JRV5-8W28-4265...

com.almis.awe:awe-annotation (>=4.11.6, <=4.12.0), com.almis.awe:awe-annotations-spring-boot-starter (>=4.11.6, <=4.12.0) +74 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.3.0, <=3.3.7)

org.springframework.ldap:spring-ldap-core MAVEN version =3.3.0, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =1.50.7, =1.51.1 and more Source cves: CVE-2026-41720 Source advisory: GHSA-JRV5-8W28-4265...

com.almis.awe:awe-annotation (>=4.11.6, <=4.12.0), com.almis.awe:awe-annotations-spring-boot-starter (>=4.11.6, <=4.12.0) +74 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.3.0, <=3.3.7)

org.springframework.ldap:spring-ldap-core MAVEN version =3.3.0, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =1.50.7, =1.51.1 and more Source cves: CVE-2026-41720 Source advisory: OSV:GHSA-JRV5-8W28-4265...

com.erudika:para-jar (>=1.51.2, <=1.51.4), com.erudika:para-server (>=1.51.2, <=1.54.7) +57 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=4.0.0, <=4.0.3)

org.springframework.ldap:spring-ldap-core MAVEN version =4.0.0, =1.51.2, =1.51.2, =0.2.2, =2.0.0, =2.0.0, =3.2.1, =3.2.1, =3.2.1, =2.5.0, =2.4.0, =2.4.0, =2.5.2 and more Source cves: CVE-2026-41720 Source advisory: GHSA-JRV5-8W28-4265...

edu.uiowa.icts.spring:spring-utils (>=2.0.10, <=2.0.11), org.codehaus.fabric3:fabric3-spring-library (>=1.6, <=1.9) +18 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (1.3.0.release)

org.springframework.ldap:spring-ldap-core MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ldap:spring-ldap-core and may be impacted: - edu.uiowa.icts.spring:spring-utils =2.0.10, =1.6, =1.6, =1.6, =3.4-rc...

com.github.ptomli.bedrock:bedrock-core (1.0.0), com.isotrol.impe3.extensions:impe3-pms-ldap (>=3.0.0, <=3.1.1) +167 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (1.3.1.release)

org.springframework.ldap:spring-ldap-core MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ldap:spring-ldap-core and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0 -...

ai.h2o:h2o-orc-parser (>=3.10.0.5, <=3.10.3.6), cc.chensoul.nacos:core-test (2.5.2) +708 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=2.0.0.release, <=2.4.4)

org.springframework.ldap:spring-ldap-core MAVEN version =2.0.0.release, =3.10.0.5, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.567.22 and more Source cves: CVE-2026-41720 Source advisory: GHSA-JRV5-8W28-4265...

CVE-2026-41720

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...