{"schema_version": "1.6.1", "id": "CVE-2026-103877", "summary": "Unsafe loading of Java code from LDAP schema elements", "details": "Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.\n\n\n\nA rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. \n\n\n\nThis issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.\n\n\n\nUsers are recommended to upgrade to version 2.1.9, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "2.1.0"}, {"fixed": "2.1.9"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread.html/sys8l881blqfgoc3o724jl32bmjl8pvw"}]}