Published on October 2, 2026, the advisory describes unsafe deserialization in Apache Directory LDAP API 2.1.0 through releases before 2.1.9. A malicious or compromised LDAP server could supply a serialized Java class and potentially enable remote code execution.
Published on October 2, 2026 and rated critical, the advisory describes untrusted-data deserialization in Apache Directory LDAP API. Affected versions are 2.1.0 through releases before 2.1.9. According to the report, during the `loadSchema()` subschema search, a malicious or compromised LDAP server can respond with a schema object containing a serialized Java class, potentially enabling remote code execution. The text also identifies an intermediary before TLS as a possible source of a tampered response.
To confirm the scope and remediation guidance, consult the original project advisory or CVE record and verify the version numbers and any updates. Rota Nacional does not fix this flaw. If you use AI to analyze the advisory or plan a response, do not submit credentials or personal data; the platform’s barrier applies the organization’s policy before model execution.