CVE-2025-61912: python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
(updated )
ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service.
References
- github.com/advisories/GHSA-p34h-wq7j-h5v6
- github.com/python-ldap/python-ldap
- github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f
- github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5
- github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6
- nvd.nist.gov/vuln/detail/CVE-2025-61912
Code Behaviors & Features
Detect and mitigate CVE-2025-61912 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →