CVE-2025-61912

MediumCVSS 5.3

Published: 10/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

python-ldap is an LDAP client API for Python. Prior to version 3.4.5, ldap.dn.escape_dn_chars() incorrectly escapes \x00 by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00, which can cause client-side denial of service.

Risk Assessment

Applications using this helper to construct DNs from untrusted input can fail before sending a request to the LDAP server, causing client-side denial of service.

Recommendation

Update python-ldap to version 3.4.5 or later, which contains a patch for this issue.

Other vulnerabilities in python-ldap

CVE-2025-61911Medium
In python-ldap versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted list or dict is supplied as the `assertion_value` parameter and the non-default `escape_mode=1` is configured. `escape_mode=0` (default) and `escape_mode=2` raise exceptions for such input, but `escape_mode=1` computes without adequate logic to ensure a fully escaped return value. If an application relies on this method to escape untrusted user input, an attacker might launch LDAP injection attacks, potentially disclosing or manipulating LDAP data.

Original NVD description (English source)

python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS