CVE-2026-103877: deserialization flaw in Apache Directory LDAP API enables RCE

Apache Directory LDAP API has a deserialization vulnerability (CWE-502) fixed in releases 2.1.9 and 1.2.9 per the October 2, 2026 advisory. An attacker with no credentials can answer a schema request with a serialized Java class and potentially execute code in the client process; no exploitation in the wild or public PoC has been reported.

• Affected ranges: 2.1.0 before 2.1.9 and 1.2.0 before 1.2.9
• Attack point is the LDAP schema exchange; no credentials required
• ZoomEye matches 154 assets for app="ApacheDS", embedded copies invisible
• Shaded or vendored copies need a vendor rebuild, not a direct patch