CVE-2026-41720

HighCVSS 7.4/10Last modified Jul 23, 2026

Description

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-417215.9Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in c CVE-2026-417225.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417238.0VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417245.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417266.5When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique r CVE-2026-417276.5Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer coul CVE-2026-417287.5Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segme CVE-2026-417298.1Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+CVE-2026-41736.3A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/expor CVE-2026-417305.3Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals CVE-2026-417318.1JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meanin CVE-2026-417328.1JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trus