CVE-2021-35472: Debian Linux

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users.

Affected products

• Debian Debian Linux: version 10.0 only
• Lemonldap-NG Lemonldap::ng: up to and including 2.0.11

Published 2021-07-30. Last modified 2026-06-17.