CVE-2016-8750: LDAP Injection Vulnerability in org.apache.karaf:apache-karaf
Summary
CVE-2016-8750: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf. Affects org.apache.karaf:apache-karaf versions < 4.0.8. Fixed in 4.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
org.apache.karaf:apache-karaf is a Maven package that provides Apache Karaf, an OSGi-based runtime environment for building and deploying applications. It includes a login module called LDAPLoginModule, which is used to authenticate users to a directory via LDAP. However, versions prior to 4.0.8 did not properly encode usernames, making them vulnerable to LDAP injection attacks. This vulnerability can lead to a denial of service.
Vulnerability Detail
The LDAP injection vulnerability in org.apache.karaf:apache-karaf allows an attacker to manipulate LDAP queries by injecting malicious input into the username field. This can result in unauthorized access, data leakage, or a denial of service. The vulnerability arises from the lack of proper encoding of usernames, which allows an attacker to modify the LDAP query and potentially execute arbitrary LDAP commands.
How To Fix
Latest published version: 4.4.12 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually encode usernames before passing them to the LDAPLoginModule. This can be done by using a secure encoding method, such as LDAP filter escaping, to ensure that any special characters are properly handled and cannot be interpreted as LDAP commands.
Conclusion
The LDAP injection vulnerability in org.apache.karaf:apache-karaf can be mitigated by upgrading to version 4.0.8 or later. It is important to ensure that usernames are properly encoded to prevent LDAP injection attacks. If immediate upgrade is not possible, manual encoding of usernames can serve as a temporary workaround. For more information and assistance, please reach out to DevNack.com.
See every vulnerability recorded for org.apache.karaf:apache-karaf →
FAQ
LDAP injection is a type of attack where an attacker manipulates LDAP queries by injecting malicious input. This can lead to unauthorized access, data leakage, or a denial of service.
This vulnerability can allow an attacker to execute arbitrary LDAP commands, potentially leading to unauthorized access, data leakage, or a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.karaf:apache-karaf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
