LDAP Client Certificates Bypass in Apache Software Foundation Products

CVE-2026-35563

What is CVE-2026-35563?

The LDAP client implementation in Apache version 2.1.7 has a significant vulnerability due to the failure to verify whether the server certificate corresponds to the intended LDAP hostname. Although the code properly checks the certificate chain against trusted authorities, the absence of hostname verification allows valid certificates from unrelated hosts to be accepted. This oversight can lead to severe risks, including server impersonation and full compromise of the connection. To mitigate these risks, hostname verification has been enforced in the new version of the LDAP API. Attackers capable of performing a man-in-the-middle (MITM) attack can exploit this vulnerability if they present a certificate that is trusted by the client’s configured trust store.

References