Apache Directory LDAP API: Unsafe deserialization of Java code from LDAP schema
Summary
The Apache Directory LDAP API, a Java library for LDAP access, deserializes Java classes contained in schema objects returned by an LDAP server during loadSchema() subschema searches. A rogue or compromised LDAP server, or a man-in-the-middle attacker on a connection before TLS is established, can use this to achieve potential remote code execution in the client application. The CVSS 3.1 base score is 9.8 (critical), and no credentials are required.
Affected
- Apache Directory LDAP API 2.1.0 up to, but not including, 2.1.9
- Default configuration: unaffected
- 1.x branch: unconfirmed, do not assume it is affected or fixed
- Debian packages 2.1.2-1 and 2.1.2-2 are listed as affected in the Debian tracker
Fixed in
- Apache Directory LDAP API 2.1.9
Workaround
- Unknown. The vendor advises upgrading. Third-party guidance suggests pinning a minimum version and restricting LDAP traffic for copies that cannot be patched directly (for example shaded or transitive copies).
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept found. EPSS score 0.00000.
Our recommendation
- Inventory Java applications and appliances that use the LDAP API, including shaded and transitive copies in lockfiles and jars.
- Upgrade to Apache Directory LDAP API 2.1.9 or later.
- Enforce LDAPS or StartTLS with certificate verification for connections to directory servers.
- Restrict which LDAP servers clients can reach and monitor for unexpected directory connections.
- Confirm with the vendor whether the 1.x branch is affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- oss-security post (Openwall) www.openwall.com
- Apache mailing list thread lists.apache.org
- Apache Directory LDAP API project page directory.apache.org
- CVE record (CVE.org) vulners.com
- Debian security tracker (OSV) osv.dev
- OpenCVE entry app.opencve.io
- Linux Security news summary linuxsecurity.com
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:27.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.