Secuno
ENNL
Book demo

CVE-2026-35563

Apache Directory LDAP API vulnerability

8.5 HIGHEPSS 0.26%
  1. Published1 Jun 2026

Description

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityHigh
Privileges requiredLow
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Apache Directory LDAP API≥ 2.0.0 < 2.1.7

Remediation

Fixed in
Apache Directory LDAP API≥ 2.1.7

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-886479.1
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the…
CVE-2026-929438.1
Improper validation of certificate with host mismatch in the MQTT client TLS connection…
CVE-2026-843938.1
A improper validation of certificate with host mismatch vulnerability in Fortinet…
CVE-2026-494579.1
erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC…
CVE-2026-481449.1
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift…
CVE-2026-427908.1
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and…

Frequently asked

Is CVE-2026-35563 being actively exploited?

CVE-2026-35563 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.26%.

How severe is CVE-2026-35563?

CVE-2026-35563 has a CVSS 3.1 base score of 8.5, rated high. EPSS estimates a 0.26% probability of exploitation.

Which products are affected by CVE-2026-35563?

Affected products include Apache Directory LDAP API.

How do I fix CVE-2026-35563?

Upgrade affected software to a fixed version, for example Apache Directory LDAP API 2.1.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-35563 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.