CVE-2026-35563
Severity CVSS v4.0:
HIGH
Type:
CWE-297
Improper Validation of Certificate with Host Mismatch
Publication date:
01/06/2026
Last modified:
01/06/2026
Description
It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP <br />
hostname. While the underlying code validates the certificate chain <br />
against a trusted authority, the absence of endpoint identification <br />
allows a valid certificate issued for an entirely unrelated host to be <br />
improperly accepted. This oversight leaves the connection highly <br />
vulnerable to server impersonation and complete connection compromise.<br />
<br />
<br />
The<br />
root cause of this vulnerability lies in the incomplete TLS server <br />
identity verification within the LDAP client implementation.<br />
<br />
<br />
<br />
<br />
The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client&#39;s configured trust store.<br />
<br />
<br />
<br />
<br />
The hostname verification has been enforced in the new version of the LDAP API
Impact
Base Score 4.0
8.80
Severity 4.0
HIGH