CVE-2026-35563 Details
Description
It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API
A vulnerability exists in the Apache Directory LDAP API client implementation in versions 2.0.0 through 2.1.7. The issue arises because the client does not verify that the server certificate corresponds to the intended LDAP hostname. Although the code checks the certificate chain against a trusted authority, the lack of endpoint identification allows a valid certificate for an unrelated host to be accepted. This flaw makes the connection susceptible to server impersonation and complete compromise. Exploitation requires a man-in-the-middle (MITM) position on the network, with the attacker presenting a certificate trusted by the client's trust store.
Hostname verification has been implemented in the new version of the Apache Directory LDAP API.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/06/01/2 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/5rc2nzqxp1m9wknyf93r8dnp46fhc1nn | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-297 | Improper Validation of Certificate with Host Mismatch | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache directory ldap api | >= 2.0.0, < 2.1.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | CVE |
| Jun 1, 2026 | New CVE Received | [email protected] |