CVE-2026-103878 — Apache Directory LDAP API: Injection of plaintext responses during StartTLS

Description (CNA)

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Directory LDAP API	affected 2.1.0 before 2.1.9

CWE

CWE-345

References

https://lists.apache.org/thread.html/d98f9w01nd3zmkwrr21y0l9kdr9jpty9

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/02/6

CISA-ADP

No English description supplied.

No references supplied.