CVE-2026-35563
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-297
Validación incorrecta de certificados con host no coincidente
Fecha de publicación:
01/06/2026
Última modificación:
03/06/2026
Descripción
*** Pendiente de traducción *** It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP <br />
hostname. While the underlying code validates the certificate chain <br />
against a trusted authority, the absence of endpoint identification <br />
allows a valid certificate issued for an entirely unrelated host to be <br />
improperly accepted. This oversight leaves the connection highly <br />
vulnerable to server impersonation and complete connection compromise.<br />
<br />
<br />
The<br />
root cause of this vulnerability lies in the incomplete TLS server <br />
identity verification within the LDAP client implementation.<br />
<br />
<br />
<br />
<br />
The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client&#39;s configured trust store.<br />
<br />
<br />
<br />
<br />
The hostname verification has been enforced in the new version of the LDAP API
Impacto
Puntuación base 4.0
8.80
Gravedad 4.0
ALTA
Puntuación base 3.x
8.50
Gravedad 3.x
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:apache:directory_ldap_api:*:*:*:*:*:*:*:* | 2.0.0 (incluyendo) | 2.1.7 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página