CVE-2026-35563: Apache LDAP API improper certificate hostname verification

CVE-2026-35563 · Severity: high · CVSS 4 · Published 2026-06-01

The Apache Directory LDAP API, a library used by applications to communicate with directory services, fails to verify that a server's security certificate matches its actual hostname. An attacker positioned between the client and the server could use a valid certificate for a different domain to impersonate the legitimate LDAP server. This could allow the attacker to intercept sensitive login credentials or manipulate directory data, potentially leading to unauthorized access to corporate systems.

Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-35563 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35563 being exploited in the wild.
How severe is CVE-2026-35563?
High severity, with a CVSS score of 4, published 1 June 2026.
Which products and versions are affected?
Apache Software Foundation LDAP API >= 2.0.0, < 2.1.8, 2.1.7; org.apache.directory.api:api-ldap-client-api (Maven) >= 2.0.0, < 2.1.8, ECOSYSTEM:introduced=2.0.0,fixed=2.1.8.
Is there a fix for CVE-2026-35563?
Yes. org.apache.directory.api:api-ldap-client-api (Maven): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35563 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35563?
Check whether you run Apache Software Foundation LDAP API or org.apache.directory.api:api-ldap-client-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.directory.api:api-ldap-client-api (Maven): upgrade to 2.1.8 or later
    # set org.apache.directory.api:api-ldap-client-api to 2.1.8 in your pom.xml or build.gradle

Technical details

The LDAP client implementation in Apache Directory LDAP API (versions 2.0.0 through 2.1.7) lacks proper TLS endpoint identification. While the library validates the certificate chain against a trusted CA, it does not verify if the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the intended LDAP hostname (CWE-297). An attacker with Man-in-the-Middle (MITM) capabilities who possesses a valid certificate for any domain trusted by the client's trust store can successfully impersonate the target LDAP server. This allows for complete connection compromise, including the interception of cleartext credentials or modification of LDAP traffic. The issue is resolved in version 2.1.8 by enforcing hostname verification.

Affected products

  • Apache Directory LDAP API >= 2.0.0, < 2.1.8

Identifiers

  • CVE-2026-35563
  • GHSA-85rw-g4f4-jprr

Timeline

  • 2026-04-09: other: Fix committed to repository
  • 2026-06-01: disclosed: Vulnerability disclosed and CVE assigned
  • 2026-06-01: advisory: GitHub Advisory published
  • 2026-07-07: other: Advisory updated with reviewed status

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.