python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-p34h-wq7j-h5v6 | python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 10 Oct 2025 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue. | |
| Title | python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination | |
| Weaknesses | CWE-116 CWE-170 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-10-10T22:04:25.028Z
Reserved: 2025-10-03T22:21:59.614Z
Link: CVE-2025-61912
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-10T22:15:37.637
Modified: 2025-10-10T22:15:37.637
Link: CVE-2025-61912
Redhat
No data.
OpenCVE Enrichment
No data.