CVE-2026-41720

Authentication Bypass with Empty Password in Spring LDAP

7.4 HighFix available

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.26%Up 0.2 points since Jun 9, 2026

What each source reports

CVE List Score used 7.4

Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Record: CVE-2026-41720
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2026-35324 7.4

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Record: EUVD-2026-35324
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jrv5-8w28-4265 7.4

Spring LDAP has Authentication Bypass with Empty Password

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Record: GHSA-jrv5-8w28-4265
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

NVD 7.4

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Record: CVE-2026-41720
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVGHSA-jrv5-8w28-4265 7.4

Spring LDAP has Authentication Bypass with Empty Password

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.

Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

Record: GHSA-jrv5-8w28-4265
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVCLSA-2026-1782176232 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.4.4-tuxcare.8.

Record: CLSA-2026-1782176232
Updated: 2026-11-02

Show 15 moreShow less

OSVCLSA-2026-1786536841 No score

TuxCare security update for org.springframework.data (3 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1786536841
Updated: 2026-11-02

OSVCLSA-2026-1786543557 No score

TuxCare security update for org.springframework.data (3 CVEs)

TuxCare rebuilt 4 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1786543557
Updated: 2026-11-02

OSVCLSA-2026-1786547094 No score

TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1786547094
Updated: 2026-11-02

OSVCLSA-2026-1788782659 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1788782659
Updated: 2026-11-02

OSVCLSA-2026-1789146534 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.4.1-tuxcare.2.

Record: CLSA-2026-1789146534
Updated: 2026-11-02

OSVCLSA-2026-1789371263 No score

TuxCare security update for org.springframework.amqp (3 CVEs)

TuxCare rebuilt 7 org.springframework.amqp packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1789371263
Updated: 2026-11-02

OSVCLSA-2026-1789400252 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.3.RELEASE-tuxcare.1.

Record: CLSA-2026-1789400252
Updated: 2026-11-02

OSVCLSA-2026-1789415252 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.2.RELEASE-tuxcare.1.

Record: CLSA-2026-1789415252
Updated: 2026-11-02

OSVCLSA-2026-1789959015 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.1.RELEASE-tuxcare.1.

Record: CLSA-2026-1789959015
Updated: 2026-11-02

OSVCLSA-2026-1791968034 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.1.

Record: CLSA-2026-1791968034
Updated: 2026-11-02

OSVCLSA-2026-1791993126 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.4.RELEASE-tuxcare.1.

Record: CLSA-2026-1791993126
Updated: 2026-11-02

OSVCLSA-2026-1792072269 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.4.2-tuxcare.1.

Record: CLSA-2026-1792072269
Updated: 2026-11-02

OSVCLSA-2026-1792141850 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 3.2.16-tuxcare.1.

Record: CLSA-2026-1792141850
Updated: 2026-11-02

OSVCLSA-2026-1792591698 No score

TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 3.0.6-tuxcare.6.

Record: CLSA-2026-1792591698
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2026-41720 No score

CVE-2026-41720 in org.springframework.ldap:spring-ldap-core - Patched by Root

Root has patched CVE-2026-41720 in the org.springframework.ldap:spring-ldap-core package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2026-41720
Updated: 2026-11-02

Affected products

spring ldap

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.ldap:spring-ldap-core` Maven	4.0.0 to 4.0.3	4.0.4
`org.springframework.ldap:spring-ldap-core` Maven	3.3.0 to 3.3.7	3.3.8
`org.springframework.ldap:spring-ldap-core` Maven	3.2.0 to 3.2.16	None known
`org.springframework.ldap:spring-ldap-core` Maven	through 2.4.4	None known
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.4.4 up to 2.4.4-tuxcare.8, plus listed versions 2.4.4-tuxcare.22.4.4-tuxcare.32.4.4-tuxcare.42.4.4-tuxcare.52.4.4-tuxcare.62.4.4-tuxcare.72.4.4.tuxcare.1	2.4.4-tuxcare.8
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	3.2.12 up to 3.2.12-tuxcare.1	3.2.12-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.4.1 up to 2.4.1-tuxcare.2, plus listed versions 2.4.1.tuxcare.1	2.4.1-tuxcare.2
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.3.3.RELEASE up to 2.3.3.RELEASE-tuxcare.1	2.3.3.RELEASE-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.3.2.RELEASE up to 2.3.2.RELEASE-tuxcare.1	2.3.2.RELEASE-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.3.1.RELEASE up to 2.3.1.RELEASE-tuxcare.1	2.3.1.RELEASE-tuxcare.1

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.1	2.3.6.RELEASE-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.3.4.RELEASE up to 2.3.4.RELEASE-tuxcare.1	2.3.4.RELEASE-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	2.4.2 up to 2.4.2-tuxcare.1	2.4.2-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	3.2.16 up to 3.2.16-tuxcare.1	3.2.16-tuxcare.1
`org.springframework.ldap:spring-ldap-core` TuxCare:Maven	3.0.6 up to 3.0.6-tuxcare.6, plus listed versions 3.0.6-tuxcare.13.0.6-tuxcare.23.0.6-tuxcare.33.0.6-tuxcare.43.0.6-tuxcare.5	3.0.6-tuxcare.6
`org.springframework.ldap:spring-ldap-core` Maven	4.0.0 up to 4.0.4, plus listed versions 4.0.14.0.24.0.3	4.0.4
`org.springframework.ldap:spring-ldap-core` Maven	3.3.0 up to 3.3.8, plus listed versions 3.3.13.3.23.3.33.3.43.3.53.3.63.3.7	3.3.8
`org.springframework.ldap:spring-ldap-core` Maven	3.2.0 to 3.2.16, plus listed versions 3.2.13.2.103.2.113.2.123.2.13 Show 10 moreShow less 3.2.143.2.153.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.9	None known
`org.springframework.ldap:spring-ldap-core` Maven	through 2.4.4, plus listed versions 1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE2.0.0.RELEASE2.0.1.RELEASE Show 18 moreShow less 2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.1.0.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.3.0.RELEASE2.3.1.RELEASE2.3.2.RELEASE2.3.3.RELEASE2.3.4.RELEASE2.3.5.RELEASE2.3.6.RELEASE2.3.7.RELEASE2.3.8.RELEASE2.4.02.4.12.4.2	None known
`org.springframework.ldap:spring-ldap-core` Root:Maven	before 3.3.6-aikido.1	3.3.6-aikido.14.0.2-aikido.13.2.0-aikido.23.2.6-aikido.2
`io.root.org.springframework.ldap:spring-ldap-core` Root:Maven	before 3.3.6-root.io.1	3.3.6-root.io.14.0.2-root.io.13.2.0-root.io.23.2.6-root.io.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 3, 2026	affected
Nov 2, 2026	affected	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41720 is a high vulnerability (CVSS 7.4) in Spring Ldap, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in org.springframework.ldap:spring-ldap-core 4.0.4.

References

Show 4 moreShow less