JAKARTA SECURITY LDAP IDENTITY STORE · CVE-2026-111262 · Package
NO FIX YET
The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter those queries to enumerate accounts, infer attribute values, or steer which directory entry a login is checked against.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that use the LDAP identity store from Jakarta Security are affected. An unauthenticated remote attacker can send crafted caller names that change the directory query, so applications that log users in against LDAP are the ones to check. Applications that do not use the LDAP identity store can skip it.
Not affected if no-ldap-identity-store, other-identity-store
Who cares jakarta-ee, java, ldap
10.3.0 and 11.0.0-M2Unknown from the sources.
The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.