CVE-2025-61912: python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service.
References
- github.com/advisories/GHSA-p34h-wq7j-h5v6
- github.com/python-ldap/python-ldap
- github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f
- github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5
- github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6
- nvd.nist.gov/vuln/detail/CVE-2025-61912
Code Behaviors & Features
Detect and mitigate CVE-2025-61912 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →