CVE-2016-8750 Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Attackers can cause denial of service in Apache Karaf by exploiting improper username encoding in LDAP authentication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8750?
CVE-2016-8750 is a medium-severity vulnerability in Apache Karaf, published on 19 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
Weakness: CWE-90
Which versions are affected by CVE-2016-8750?
2 open source packages ship an affected version, including org.apache.karaf:apache-karaf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.karaf:apache-karaf Maven | All versions | 4.0.8 |
org.apache.karaf:apache-karaf Maven | All versions | 4.0.8 |
Products include Apache Karaf.
How do I fix CVE-2016-8750?
Upgrade org.apache.karaf:apache-karaf to 4.0.8 or later.
Is CVE-2016-8750 being exploited?
There is no known exploitation of CVE-2016-8750 in the wild and no public exploit code.
Other vulnerabilities in Apache Karaf
- CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- CVE-2026-91048 Missing authorization in Apache Karaf
- CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection
- CVE-2018-11788 XML External Entity Reference in Apache Karaf
- CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Sources
Also known as GHSA-chj8-5xgw-wcvj.