# CVE-2026-103877: Apache Directory LDAP API Java deserialization in loadSchema

Source: https://junglewise.ai/threats/cve-2026-103877-deserialization-of-untrusted-data-vulnerability-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103877 · Severity: info · Published 2026-10-02

Apache Directory LDAP API is a Java library for LDAP client communication. A rogue or compromised LDAP server can exploit the loadSchema() method by responding with a malicious schema object containing serialized Java code, potentially leading to remote code execution on client applications.

Technologies: [Apache Directory Ldap Api](https://junglewise.ai/threats/technologies/directory-ldap-api). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-103877 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103877 being exploited in the wild.

**How severe is CVE-2026-103877?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Apache Directory Ldap Api 2.1.0 before 2.1.9.

**Is there a fix for CVE-2026-103877?** Yes: fixed in 2.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103877 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103877?** Check whether you run Apache Directory Ldap Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.1.9

## Technical details

A deserialization vulnerability in Apache Directory LDAP API's loadSchema() subschema search allows an attacker controlling or intercepting an LDAP server connection (including pre-TLS MITM scenarios) to inject a serialized Java class object in the schema response. This leads to arbitrary code execution when the client deserializes the untrusted object. The vulnerability requires network-level attack capability and affects version 2.1.0 through 2.1.8.

## Affected products

- Apache Directory LDAP API 2.1.0 before 2.1.9

## Timeline

- 2026-10-02: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/sys8l881blqfgoc3o724jl32bmjl8pvw](https://lists.apache.org/thread.html/sys8l881blqfgoc3o724jl32bmjl8pvw)

## Related threats

- [Apache Directory LDAP API DoS via malformed telephone numbers](https://junglewise.ai/threats/cve-2026-103885-asymmetric-resource-consumption-vulnerability-in-apache)
- [Apache Directory LDAP API asymmetric resource consumption in bcrypt](https://junglewise.ai/threats/cve-2026-103880-asymmetric-resource-consumption-vulnerability-in-apache)
- [Apache Directory LDAP API cleartext transmission of sensitive information in StartTLS](https://junglewise.ai/threats/cve-2026-103878-cleartext-transmission-of-sensitive-information-vulnerability-in)
- [Apache Directory LDAP API stack overflow in search filter decoder](https://junglewise.ai/threats/cve-2026-103552-stack-overflow-vulnerability-in-apache-directory-ldap-api-before)
- [Apache Directory LDAP API memory allocation denial of service](https://junglewise.ai/threats/cve-2026-102731-memory-allocation-with-excessive-size-value-vulnerability-in)