Apache Directory LDAP EUVD-2026-91378

Exploitation requires a specific condition: an application using Apache Directory LDAP API where a StartTLS extended operation is initiated AFTER a Search request has already been sent, creating a window in which data is transmitted in cleartext before the TLS handshake completes. The attacker must also hold a network interception position (passive eavesdropping or active man-in-the-middle) on the path between the LDAP client and server to observe the plaintext. LIMITING FACTORS: the attacker gains nothing without on-path network access; the leak is confined to the pre-handshake window of a StartTLS-after-Search sequence; and only versions 2.1.0 through 2.1.8 are affected (fixed in 2.1.9). No authentication or user interaction is needed on the target application itself, but the required interception position substantially limits realistic exploitation.

This is a moderate-severity information-disclosure flaw (CWE-345) with signals pointing toward LOW real-world urgency despite its 7.5 CVSS. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) scores only confidentiality impact as High with no integrity or availability effect. EPSS is very low at 0.13% (2nd percentile), there is no CISA KEV listing, and no public POC was identified - three independent signals that converge on low likelihood of opportunistic mass exploitation. Importantly, the CVSS AC:L rating understates the practical barrier: this is a client-side LDAP library flaw where StartTLS data can be sent before the TLS handshake completes, so exploitation realistically requires an attacker already positioned on-path (passive eavesdropper or active MITM) to capture the brief plaintext window - a precondition CVSS encodes poorly. CONFLICT TO NOTE: CVSS marks AV:N/AC:L (easy remote exploitation), but the vulnerability description (plaintext leakage during a StartTLS race) implies the attacker must intercept network traffic at a specific timing window, which is better modeled as higher attack complexity. Net: a legitimate confidentiality concern for sensitive LDAP data (credentials, directory contents) worth patching on normal cycles, but not an emergency given low EPSS, no KEV, no POC, and the required interception position.

An attacker with a man-in-the-middle or passive on-path position on the network between a Java application (using Apache Directory LDAP API 2.1.0-2.1.8) and its LDAP server observes that a Search request is issued and StartTLS is initiated afterward. Because data can be transmitted in cleartext before the TLS handshake completes, the attacker captures sensitive search traffic - potentially including bind credentials or directory data - in plaintext. No public exploit identified at time of analysis; exploitation hinges on network interception and the specific StartTLS-after-Search ordering.