7.4 HighCWE-287
CVE-2026-41720
Spring LDAP vulnerability
SpringSpring LDAP
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 22 Oct
0.4%probability of exploitation in the next 30 days
Higher than 32% of scored CVEs
SeverityCVSS
7.4High
Description NVD
Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.
Coverage 1 article · 1 outlet
- Spring Framework flaws allow LDAP bypass and DoS on Java cloudsSecurityOnline · first in our coverage