Apache OpenOffice’s 2 October 2026 advisory warns that opening a crafted, untrusted document can trigger arbitrary code execution through Java integration. The project said a fix was expected in version 4.1.17, which was still in release-candidate phase when the notice appeared. The same day’s Apache LDAP API notices describe four issues with stated affected versions and fixes, while the Traffic Server advisory expands the stated exposure for the 9.2.x branch.
This roundup covers Apache project notices published on 2 October 2026, checked against the information available on 3 October. Release status and affected-version guidance can change; use each project’s current advisory and release information when assessing a particular package or deployment.
As an Amazon Associate I earn from qualifying purchases.
At a glance: affected versions and fixes
| Project and issue | Affected versions stated in the advisory | Impact or attack condition | Recommended fixed version |
|---|---|---|---|
| Apache OpenOffice, CVE-2026-59265 | Through 4.1.16 | Opening a crafted untrusted document can execute arbitrary code through Java integration, potentially including remote code. | 4.1.17 was expected to fix the issue; it was in release-candidate phase when the notice was posted. |
| Apache Directory LDAP API, CVE-2026-102731 | 1.2.0 before 1.2.9 | A malicious peer or man-in-the-middle can provoke excessive memory allocation during BER decoding, potentially causing an OutOfMemoryError and denial of service. |
1.2.9 |
| Apache Directory LDAP API, CVE-2026-103552 | 1.2.0 before 1.2.9 | A deeply nested search filter sent before binding can overflow the server decoder’s stack. | 1.2.9 |
| Apache Directory LDAP API, CVE-2026-103877 | 2.1.0 before 2.1.9 | A rogue or compromised LDAP server, or a man-in-the-middle before TLS, can return a schema object containing a serialized Java class during loadSchema(), creating potential remote code execution. |
2.1.9 |
| Apache Directory LDAP API, CVE-2026-103878 | 2.1.0 before 2.1.9 | A StartTLS operation initiated after a Search request can allow plaintext responses to arrive before the TLS handshake completes. | 2.1.9 |
| Apache Directory LDAP API, CVE-2026-103880 | Not stated in the 2 October oss-security archive index entry. | The index title describes denial of service through an excessive bcrypt cost factor in stored passwords; further details are not stated in that entry. | Not stated in the 2 October oss-security archive index entry. |
| Apache Directory LDAP API, CVE-2026-103885 | Not stated in the 2 October oss-security archive index entry. | The index title describes denial of service through crafted telephone-number values; further details are not stated in that entry. | Not stated in the 2 October oss-security archive index entry. |
| Apache Traffic Server, CVE-2026-102795 | 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 | Improper access control involving the policy for matching SNI to the Host header. | 9.2.15 or 10.1.4 |
The advisories’ severity labels should not be treated as directly comparable across projects: the notices do not establish a common scoring method, and the captured announcements do not provide CVSS scores.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Apache OpenOffice: disable Java integration while awaiting the fix
What the advisory means
Apache OpenOffice advisory author Dave Fisher described CVE-2026-59265 as critical. The user must open the crafted document for the described execution path; simply receiving or storing a file is not the condition specified in the notice.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
The OpenOffice bulletin places CVE-2026-59265 under “Disclosed in Apache OpenOffice 4.1.16.” That heading identifies the disclosure section; it does not mean 4.1.16 contains a fix. The detailed advisory says that version is affected. The bulletin separately identifies seven other CVEs as fixed in 4.1.16.
What to do now
- Open Apache OpenOffice’s Preferences dialog and disable Java runtime integration.
- If you cannot disable Java integration, avoid opening untrusted files until a fixed release is available.
- When 4.1.17 is generally available, check the project’s release and security information, then update using a trusted distribution channel.
Do not treat the release candidate as a confirmed general release: the 2 October notice only said 4.1.17 was expected to address the issue and was in release-candidate phase at that time.
Apache Directory LDAP API: four detailed issues and two index-only entries
The 2 October oss-security archive index lists six LDAP API CVEs. The four detailed messages summarized above recommend moving affected 1.2.x installations to 1.2.9 and affected 2.1.x installations to 2.1.9. Administrators should identify the LDAP API version actually bundled or deployed in their application, then apply the corresponding project update and test integrations that depend on it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFor CVE-2026-103880 and CVE-2026-103885, the index supplies titles but not enough advisory detail to establish affected versions, severity, or fixed releases. Do not infer those details from the titles; consult the complete project advisories before deciding whether a particular deployment is affected or what version resolves the issue.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Apache Traffic Server: reassess 9.2.x exposure
The 2 October notice says CVE-2026-102795 supersedes CVE-2026-41920. Its author specifically warns that all 9.2.x releases before 9.2.15 are affected. Operators who previously concluded that a 9.2.x installation was outside the earlier notice’s range should reassess it against the newer advisory and move to an indicated fixed version.
Quick Recap
Best Value
- Easy To Track Your Finances: HAUTOCO accounting ledger book keeps you on top of your expenses and income! Help you keep your money organized, spend well, and set and achieve financial goals
- Premium Material: The A5 accounting ledger book has a total of 120 pages and 2040 lines of entries. It is made of 100gsm thick paper to reduce ink leakage; it is equipped with a waterproof and sturdy PP cover to protect the inner pages
- Practical Design: Compact 8.3 x 6.2'' expense tracker notebook is easy to carry and features information pages, 2025 calendar, yearly financial goals page, and PVC pocket for storing important tickets and loose items
- Manage Your Finances Effectively: Undated accounting books with number, date, description, account, payment or deposit amount, and total balance. You will be able to easily analyze your financial activities and quickly prepare accurate financial statements
- Ideal For Small Business or Personal Use: An accounting log journal can track your business or personal financial status. With a clear record of transactions, you can find unnecessary expenses or fraudulent charges
Rank #4
- Tabbed alphabetical pages that provide space for noting website addresses, usernames, passwords, and extra details.
- There are also pages in the back for recording additional information about your computer system.
- The removable cover label and plain black logbook covers help keep your organizer discreet.
- Mini logbook measures just 3-1/8'' wide x 5-1/4'' high.
- 144 pages.
How to verify whether a package or deployment is affected
- Check the version actually running or bundled, not only the version listed by a system package manager; vendors may patch or backport fixes without changing the upstream version number.
- Match that package and configuration against the relevant project’s advisory and release notes. Apache guidance directs users with questions about published issues or specific releases to project advisories and user lists.
- Use the Apache Security Team contact for reporting undisclosed vulnerabilities, not routine questions about already published advisories.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
