python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-ldap | python-ldap | before 3.4.5 | 3.4.5 | Patch available | CNA |
| — | python-ldap (PyPI) | before 3.4.5 | 3.4.5 | Patch available | GHSA-p34h-wq7j-h5v6 |
- python-ldap Vendorpython-ldap Affected before 3.4.5 Fixed in 3.4.5 Patch available CNA
- python-ldap (PyPI) Vendor— Affected before 3.4.5 Fixed in 3.4.5 Patch available GHSA-p34h-wq7j-h5v6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python-ldap:python-ldap:*:*:*:*:*:*:*:* | before 3.4.5 | Vulnerable | python-ldap |
- cpe:2.3:a:python-ldap:python-ldap:*:*:*:*:*:*:*:* Versions before 3.4.5 Vulnerable ·python-ldap
Remediation
- Fix · CNA python-ldap (python-ldap) Fixed in 3.4.5
- Fix · GHSA-p34h-wq7j-h5v6 python-ldap (PyPI) Fixed in 3.4.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61912
- 2026-10-03 Alias added: GHSA-p34h-wq7j-h5v6
References
More Python-ldap vulnerabilities
- TI-2025-38261 python-ldap has sanitization bypass in ldap.filter.escape_filter_chars CVSS 4.0MEDIUM 5.5
- TI-2021-21516 python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-61912 · CVE Program
- CVE-2025-61912 · NVD
- FIRST EPSS
- GHSA-p34h-wq7j-h5v6 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-61912 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences