CVE-2026-35563: Apache Directory LDAP API Hostname Verification Bypass

Technical summary

CVE-2026-35563 is a server identity verification bypass (CWE-297) in Apache Directory LDAP API 2.1.7. The TLS implementation performs chain validation against trusted certificate authorities but omits hostname verification, permitting an attacker with man-in-the-middle (MITM) capability to present a validly-signed certificate for an unrelated hostname. The server identity is never verified against the intended target, enabling complete connection compromise and impersonation of legitimate LDAP infrastructure.

Business impact

This vulnerability enables attackers to silently intercept and manipulate LDAP authentication flows. In enterprise environments where LDAP provides centralized authentication and directory services, a compromised connection could allow credential harvesting, unauthorized access to directory information (users, groups, roles), or injection of malicious authentication responses. The risk is amplified in on-premises deployments where LDAP credentials govern access to critical systems and applications.

Affected systems

Apache Directory LDAP API version 2.1.7 is affected. Systems using this library for LDAP client connections are at risk, particularly applications performing user authentication, directory lookups, or group membership queries. Organizations should identify all deployed applications that depend on this LDAP API version through software inventory and dependency scanning.

Exploitability

The vulnerability requires both network-level MITM positioning and possession of a valid certificate trusted by the target client's certificate store. The attacker does not need valid LDAP credentials (PR:L in the CVSS vector suggests low privilege escalation, but the actual attack posture requires network access). While the barrier to exploitation is moderate—requiring specific network conditions and a legitimate certificate—the impact is severe once achieved, making this a credible threat in environments with untrusted network segments or where LDAP traffic crosses security boundaries.

Remediation

Upgrade Apache Directory LDAP API to a version that enforces hostname verification. The vendor has released an updated version with hostname verification controls enabled by default. Organizations should prioritize patching systems performing LDAP authentication, particularly in production directory services and single sign-on (SSO) infrastructure. As an interim control, restrict LDAP client connections to trusted, isolated network segments and monitor for unexpected certificate warnings or connection failures.

Patch guidance

Verify the availability of a patched release from the Apache Directory project that re-enables or implements hostname verification. Apply patches first to non-production LDAP clients to validate compatibility with your authentication infrastructure. Test authentication flows, user lookups, and group membership queries after patching. Ensure that custom LDAP configurations or certificate pinning policies are reviewed post-update. Consult the vendor security advisory for specific version numbers and migration guidance.

Detection guidance

Monitor LDAP client logs for certificate validation warnings, hostname mismatches, or TLS errors during connection establishment. Network detection should flag unusual certificate presentations for LDAP ports (389, 636) where the Subject or Subject Alt Name does not match the destination hostname. Implement certificate pinning or strict hostname verification policies at the application level if the underlying LDAP library does not provide it. Review firewall and proxy logs for unexpected LDAP traffic redirects or certificate issuance anomalies.

Why prioritize this

This vulnerability merits rapid patching due to its HIGH severity score (8.5), broad impact scope (affects all confidentiality, integrity, and availability properties), and direct implications for authentication infrastructure. Although exploitation requires MITM positioning, organizations with distributed or hybrid network architectures, untrusted WiFi, or third-party LDAP services should treat this as a critical priority. Compromised LDAP flows directly undermine the security of downstream systems relying on directory authentication.

Risk score, explained

CVSS 3.1 score of 8.5 reflects high-impact consequences (C:H, I:H, A:H—full confidentiality, integrity, and availability compromise across scope change) balanced against moderate attack complexity (AC:H, requiring network positioning and a trusted certificate). The low privilege requirement (PR:L) reflects that an unauthenticated network attacker must first achieve MITM position but does not require prior system access. The score appropriately escalates this from a theoretical to a material threat.

Frequently asked questions