GHSA-JRV5-8W28-4265 Spring LDAP has Authentication Bypass with Empty Password

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

CVE-2026-41720

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

CVE-2026-41720

CVE-2026-41720 affects Spring LDAP, where DirContextAuthenticationStrategy implementations fail to reject a bind request that uses a non-empty username with an empty or null password. Affected versions include 2.4.0–2.4.4, 3.2.0–3.2.17, 3.3.0–3.3.7, and 4.0.0–4.0.3. The CVE description in both th...

CVE-2026-41720 Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

VMware Spring LDAP 授权问题漏洞

VMware Spring LDAP is an LDAP directory service integration framework developed by the American company VMware. There were vulnerabilities related to authorization in versions of VMware Spring LDAP from 2.4.0 to 2.4.4, 3.2.0 to 3.2.17, 3.3.0 to 3.3.7, and 4.0.0 to 4.0.3. These vulnerabilities...

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

ai.h2o:h2o-orc-parser (>=3.10.0.5 <=3.10.3.6), cc.chensoul.nacos:core-test (=2.5.2) +232 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=2.4.0 <=2.4.4)

org.springframework.ldap:spring-ldap-core MAVEN version =2.4.0, =3.10.0.5, =1.2.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.7.0 and more Source cves: CVE-2026-41720 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKLDAP-17260845...

Incorrect Implementation of Authentication Algorithm

Overview org.springframework.ldap:spring-ldap-core is a maven plugin for LDAP for Sping. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm via LDAP authentication handling in DirContextAuthenticationStrategy implementations. An attacker can...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0-20260516144515 <=1.0.0.ee-20260528111216), cc.zzzyu.nacos:default-auth-plugin (=3.1.1) +145 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.2.0 <=3.3.7)

org.springframework.ldap:spring-ldap-core MAVEN version =3.2.0, =1.0.0-20260516144515, =0.0.13, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.12.0 and more Source cves: CVE-2026-41720 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKLDAP-17260845...

com.erudika:para-jar (>=1.51.2 <=1.51.4), com.erudika:para-server (>=1.51.2 <=1.54.7) +52 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=4.0.0-M1 <=4.0.3)

org.springframework.ldap:spring-ldap-core MAVEN version =4.0.0-M1, =1.51.2, =1.51.2, =0.2.2, =2.0.0, =2.0.0, =3.2.1, =3.2.1, =3.2.1, =2.5.0, =2.4.0, =2.4.0, =2.5.2 and more Source cves: CVE-2026-41720 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKLDAP-17260845...

EUVD-2022-4787

Malicious code in bioql PyPI...

EUVD-2024-3490

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2024-38829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through...

Sensitive Information Exposure

org.springframework.ldap:spring-ldap-core is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of case conversions using String.toLowerCase and String.toUpperCase methods, which can have locale-dependent exceptions. This may lead to unintended columns bei...

CVE-2024-38829

A flaw was found in Spring LDAP. The usage of String.toLowerCase and String.toUpperCase has some locale dependent exceptions that could result in unintended columns being queried...

GHSA-MQVR-2RP8-J7H4 Spring LDAP data exposure vulnerability

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase and...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0-20260516144515 <=1.0.0.ee-20260528111216), cc.zzzyu.nacos:default-auth-plugin (=3.1.1) +140 more potentially affected by CVE-2024-38829 via org.springframework.ldap:spring-ldap-core (>=3.0.0 <=3.2.7)

org.springframework.ldap:spring-ldap-core MAVEN version =3.0.0, =1.0.0-20260516144515, =0.0.11, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.11.5 and more Source cves: CVE-2024-38829 Source advisory: OSV:GHSA-MQVR-2RP8-J7H4...

be.dnsbelgium:rdap-server (>=0.3.3 <=1.1.0), cc.chensoul.nacos:core-test (=2.5.2) +866 more potentially affected by CVE-2024-38829 via org.springframework.ldap:spring-ldap-core (>=1.3.0.RELEASE <=2.4.2)

org.springframework.ldap:spring-ldap-core MAVEN version =1.3.0.RELEASE, =0.3.3, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.567.22 and more Source cves: CVE-2024-38829 Source advisory: OSV:GHSA-MQVR-2RP8-J7H4...

Spring LDAP data exposure vulnerability

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase and...

CVE-2024-38829

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase and...