CVE-2026-103878

7.5 Élevée

Publiée le 02/10/2026 à 12:17 · Modifiée le 05/10/2026 à 21:17 · Analyse NVD reportée · Source : security@apache.org

Description

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Directory LDAP API

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-345

Références

https://lists.apache.org/thread.html/d98f9w01nd3zmkwrr21y0l9kdr9jpty9
http://www.openwall.com/lists/oss-security/2026/10/02/6

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories