AIKIDO-2026-411679
api-ldap-schema-data is vulnerable to Insecure Deserialization
95
Critical Risk
This Affects:
api-ldap-schema-dataTL;DR
When a client loads schema from an LDAP server, SchemaEntityFactory can build syntax checkers, comparators, and normalizers from class bytes in the entry’s m-bytecode attribute. A rogue or man-in-the-middle server can send malicious bytecode, and the client will run it with the application’s privileges. The fix turns bytecode loading off by default: it only works if org.apache.directory.api.ldap.schema.loader.allowBytecodeLoading is set, and the loaded class must be a SyntaxChecker, LdapComparator, or Normalizer.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application loads schema from an LDAP server you do not fully trust or from a connection that can be intercepted before TLS.
Background info
api-ldap-schema-data is vulnerable to Insecure Deserialization in versions 2.1.0 - 2.1.8.
How to fix this
Upgrade the org.apache.directory.api:api-ldap-schema-data library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.