Skip to content

CVE record · 1 source

CVE-2026-111262

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries.

Vendor: Apache Software Foundation
Product: Apache TomEE
Weakness: CWE-90
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

CVE NVD 2h ago

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries.

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer…

Fix available CVE-2026-111262 Apache Software Foundation