Apache
CVE-2026-111262: The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticate
CVE-2026-111262 Nov 10, 2026 Source: Vendor
In brief. Apache published CVE-2026-111262: The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticate on November 10, 2026. It credits 1 researcher or team for 1 CVE.
The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-111262
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1