VulnSocial

CVE-2026-35563General(apache / directory_ldap_api)

LOWCVSS 8.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-297

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • directory_ldap_api

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-06-02)
  • 3 total mentions across 2 days

Affected systems

Vendors
apache
Products
directory_ldap_api

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-01: 1Mentions · 2026-06-02: 2Technical Details · 2026-06-02: 106-0106-02
Signal classification2 categories
General
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-011
General1
2026-06-022
Disclosure1General1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-35563: Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname https://www.openwall.com/lists/oss-security/2026/06/01/2 Severity: important

    Post summary

    The message announces CVE‑2026‑35563, describing a hostname verification flaw in the Apache Directory LDAP API, but provides no PoC, exploit, patch, or evidence of active exploitation.

    01030473
    4.7K followersView on X
  • CVETrends@CVEShield
    General

    Top 5 Trending CVEs: 1 - CVE-2024-21182 2 - CVE-2026-40369 3 - CVE-2026-0257 4 - CVE-2023-41011 5 - CVE-2026-35563 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

    Post summary

    A short list of trending CVE identifiers is posted, without further context, technical details, or claims of exploitation or mitigation.

    00030203
    1.7K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-35563 CVE-2026-35563 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35563

    Post summary

    The post simply lists the CVE identifier and links to a vulnerability details page without additional technical or threat information.

    0000050
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachedirectory_ldap_api---

Explore more

Back to dashboardapache CVEsdirectory_ldap_api vulnerabilities