Executive brief
The Apache Directory LDAP API, a library used by applications to communicate with directory services, fails to verify that a server's security certificate matches its actual hostname. An attacker positioned between the client and the server could use a valid certificate for a different domain to impersonate the legitimate LDAP server. This could allow the attacker to intercept sensitive login credentials or manipulate directory data, potentially leading to unauthorized access to corporate systems.
Technical details
The LDAP client implementation in Apache Directory LDAP API (versions 2.0.0 through 2.1.7) lacks proper TLS endpoint identification. While the library validates the certificate chain against a trusted CA, it does not verify if the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the intended LDAP hostname (CWE-297). An attacker with Man-in-the-Middle (MITM) capabilities who possesses a valid certificate for any domain trusted by the client's trust store can successfully impersonate the target LDAP server. This allows for complete connection compromise, including the interception of cleartext credentials or modification of LDAP traffic. The issue is resolved in version 2.1.8 by enforcing hostname verification.
Affected products
- Apache Directory LDAP API >= 2.0.0, < 2.1.8
Timeline
- 2026-04-09: other: Fix committed to repository
- 2026-06-01: disclosed: Vulnerability disclosed and CVE assigned
- 2026-06-01: advisory: GitHub Advisory published
- 2026-07-07: other: Advisory updated with reviewed status