CVE-2026-103877

Apache Directory LDAP API loads schema implementation classes without restriction when a client retrieves the schema of an LDAP server. In SchemaEntityFactory, the methods classLoadSyntaxChecker, classLoadComparator and classLoadNormalizer initialize a class by name with Class.forName or define it from the m-bytecode attribute of a schema entry, then instantiate it by reflection without an opt-in and without checking that it is a syntax checker, comparator or normalizer. A rogue or man-in-the-middle LDAP server can answer the subschema search issued by loadSchema() with an entry carrying a serialized Java class, which leads to arbitrary code execution in the client JVM.