CVE-2022-37186: Lemonldap-NG Lemonldap::ng

Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days.

In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.

Affected products

• Lemonldap-NG Lemonldap::ng: before 2.0.15 (fixed in 2.0.15)

Published 2023-04-16. Last modified 2026-06-17.