What is the CVSS score of CVE-2026-41720?

CVE-2026-41720 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring LDAP are affected by CVE-2026-41720?

Spring LDAP, a critical authentication framework used by Java applications, contains an authentication bypass vulnerability (CVE-2026-41720) affecting versions 2.4.0-2.4.4, 3.2.0-3.2.17, 3.3.0-3.3.7,…. A patch is available.

How to fix or mitigate CVE-2026-41720?

24 hours: Inventory all Java applications running Spring LDAP 2.4.0-2.4.4, 3.2.0-3.2.17, 3.3.0-3.3.7, or 4.0.0-4.0.3; enable detailed LDAP bind logging to detect suspicious authentication attempts. 7 days: Implement rate limiting on failed LDAP authentication attempts, deploy network-level restrictions to limit LDAP bind operations to trusted sources, and conduct LDAP configuration audit to disable anonymous binds. 30 days: Establish monitoring for Spring LDAP security advisories and develop upgrade plan to apply vendor patch immediately upon availability.

Spring LDAP CVE-2026-41720

EUVD-2026-35324 HIGH

Improper Authentication (CWE-287)

2026-06-09 vmware

GHSA-jrv5-8w28-4265

Authentication Bypass Java Spring Ldap

7.4

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:09 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

43 maven packages depend on org.springframework.ldap:spring-ldap-core (9 direct, 34 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Authentication bypass in Spring LDAP's DirContextAuthenticationStrategy allows remote unauthenticated attackers to succeed at LDAP bind operations by supplying any non-empty username paired with an empty or null password, due to the framework failing to reject such anonymous-equivalent bind requests. Affected releases span Spring LDAP 2.4.0-2.4.4, 3.2.0-3.2.17, 3.3.0-3.3.7, and 4.0.0-4.0.3, putting Java applications that delegate authentication to these libraries at risk of impersonating arbitrary users. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Spring LDAP is a Java library maintained by VMware/Broadcom that abstracts LDAP operations for Spring-based applications, commonly used to integrate with Active Directory and OpenLDAP for authentication and directory queries. The DirContextAuthenticationStrategy hierarchy (including SimpleDirContextAuthenticationStrategy, DefaultTlsDirContextAuthenticationStrategy, and ExternalTlsDirContextAuthenticationStrategy) configures how the JNDI DirContext is initialized when binding to a directory server. The vulnerability maps to CWE-287 (Improper Authentication): per RFC 4513, an LDAP bind with a non-empty DN but empty password must be rejected, since many directory servers silently treat such binds as anonymous and return success - Spring LDAP's strategies failed to enforce this RFC-mandated check, causing the application layer to interpret a successful anonymous bind as proof that the supplied credentials are valid. The affected CPE is cpe:2.3:a:spring:spring_ldap, covering all maintained 2.4, 3.2, 3.3, and 4.0 lines.

RemediationAI

Upgrade Spring LDAP to a fixed release on your current maintenance branch: per the version ranges in the advisory the upstream fix is available in versions later than 2.4.4, 3.2.17, 3.3.7, and 4.0.3 (consult https://spring.io/security/cve-2026-41720 for the exact patched release labels before deploying, as released patched version is not independently confirmed in this dataset beyond the closed ranges). Until the upgrade is rolled out, mitigate at the application layer by explicitly rejecting authentication attempts with empty or null passwords before invoking any Spring LDAP bind call - this fully neutralizes the issue with no side effect other than a small code change in your authentication entry points. As a secondary control, configure the backing directory server to refuse unauthenticated/anonymous binds (e.g. OpenLDAP olcDisallows: bind_anon, Active Directory's 'LDAP server channel binding and signing' hardening), accepting the trade-off that any legitimate anonymous-bind workflows you rely on for directory browsing will need to be reworked.