Loading story…
Apache disclosed CVE-2026-48827, a path traversal flaw in the org.apache.sshd:sshd-git bundle of Apache MINA SSHD that lets an SSH-authenticated user escape the configured Git root by supplying repository paths containing traversal sequences such as ../. The issue affects sshd-git versions 2.0.0 through 2.17.1 and 3.0.0-M1 through 3.0.0-M3, impacting git-upload-pack, git-receive-pack, and related operations. Successful exploitation can expose arbitrary Git repositories on the server filesystem and, in some cases, allow unauthorized writes outside the intended root. Apache fixed the bug in versions 2.18.0 and 3.0.0-M4 by adding centralized path validation, and noted that deployments using Apache MINA SSHD without the non-default sshd-git module are not affected.
Apache also disclosed CVE-2026-35563 in the Apache Directory LDAP API client, where versions 2.0.0 through 2.1.7 failed to verify whether a TLS server certificate matched the intended LDAP hostname. Because the client would accept a trusted certificate issued for an unrelated host, an attacker with man-in-the-middle network access could impersonate the LDAP server and fully compromise the connection. The flaw is tracked as CWE-297, and Apache said hostname verification is now enforced in a newer LDAP API release. The disclosures highlight two separate Apache security fixes affecting repository isolation in SSH-based Git services and certificate validation in LDAP client connections.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-35563 was reported to security@apache.org on June 1, 2026. The issue involves missing hostname verification in LDAP client TLS checks, and Apache said a newer version enforces hostname verification.
Apache fixed CVE-2026-48827 in MINA SSHD versions 2.18.0 and 3.0.0-M4 in May 2026 by adding centralized path validation for Git repository resolution.
Apache disclosed CVE-2026-35563, a hostname verification flaw in the LDAP API client affecting versions 2.0.0 through 2.1.7 that can enable server impersonation in a man-in-the-middle scenario.
On the oss-sec mailing list, Apache disclosed CVE-2026-48827 affecting sshd-git versions 2.0.0 through 2.17.1 and 3.0.0-M1 through 3.0.0-M3, and advised upgrading to 2.18.0 or 3.0.0-M4.
Apache credited j0hndo with reporting CVE-2026-48827, a path traversal flaw in the sshd-git bundle that can let SSH-authenticated users access repositories outside the configured Git root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
aretiq.ai
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-56452**, a moderate-severity path traversal flaw in the `sshd-scp` component of **Apache MINA SSHD** that lets a malicious SCP sender write files to attacker-controlled locations during file reception. The issue stems from improper validation of filenames supplied in SCP `C` or `D` commands, creating a risk for applications that use Apache MINA SSHD to receive files over SCP. The vulnerability affects `org.apache.sshd:sshd-scp` through **2.18.0** and **3.0.0-M1** through **3.0.0-M4**. Apache said applications using Apache MINA SSHD **2.0.0 or later** are impacted only if they rely on `sshd-scp` for inbound file transfers, and it released fixes in **2.19.0** and **3.0.0-M5**. The flaw was reported by **Unbbal**.
Jul 20, 2026
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026
Microsoft disclosed **CVE-2026-34339**, an **Important** denial-of-service flaw in **Windows Lightweight Directory Access Protocol (LDAP)** caused by a `NULL` pointer dereference. The company said an authorized local attacker with low privileges could trigger the bug without user interaction, causing a loss of availability but not affecting confidentiality or integrity. Microsoft assigned the issue a **CVSS 3.1 score of 5.5**, said exploitation is considered less likely, and reported no public disclosure or active exploitation at publication; a vendor fix is available. Microsoft also published **CVE-2026-29169**, a denial-of-service vulnerability affecting **Apache HTTP Server `mod_dav_lock`** through an indirect lock crash tied to **CWE-476 NULL Pointer Dereference**. That flaw carries a **CVSS 3.1 score of 7.5** and is rated remotely exploitable over the network with no privileges or user interaction required, again impacting availability rather than confidentiality or integrity. The disclosures follow earlier Microsoft advisories for Windows denial-of-service issues including **CVE-2024-49113** and **CVE-2024-49121** in LDAP and **CVE-2025-59259** in the Windows Local Session Manager.
Jun 29, 2026