PT-2026-141740

CVE-2026-111262

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Researchers
Vendors
Affected products
Weakness enumeration
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\'LDAP Injection\')
Related identifiers
CVE-2026-111262
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com