Bug 2544999 (CVE-2026-103878)

Summary:	CVE-2026-103878 org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Information disclosure via improper StartTLS operation handling
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gmalinko, janstey, pdelbell, rstepani
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Apache Directory LDAP API. When a StartTLS operation is initiated after a search request has already been sent, the client can receive response data in cleartext before the Transport Layer Security (TLS) handshake completes. An attacker capable of intercepting network traffic can exploit this vulnerability to read sensitive directory data transmitted in plain text.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-02 10:21:50 UTC

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API.



A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed.



This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9.



Users are recommended to upgrade to version 2.1.9, which fixes the issue.