CVE-2025-61912

python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f	Patch
https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5	Release Notes
https://github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python-ldap:python-ldap:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) python-ldap es una API cliente de protocolo ligero de acceso a directorios (LDAP) para Python. En versiones anteriores a la 3.4.5, ldap.dn.escape_dn_chars() escapa \x00 incorrectamente al emitir una barra invertida seguida de un byte NUL literal en lugar de la forma hexadecimal RFC-4514 \00. Cualquier aplicación que utilice esta función auxiliar para construir DNs a partir de entradas no confiables puede hacerse que falle consistentemente antes de que se envíe una solicitud al servidor LDAP (p. ej., AD), lo que resulta en una denegación de servicio del lado del cliente. La versión 3.4.5 contiene un parche para el problema.

Information

Published : 2025-10-10 22:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-61912

Mitre link : CVE-2025-61912

CVE.ORG link : CVE-2025-61912

JSON object : View

Products Affected

python-ldap

python-ldap

CWE

CWE-116

Improper Encoding or Escaping of Output

CWE-170

Improper Null Termination

{"id": "CVE-2025-61912", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61912", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T14:57:58.750366Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "python-ldap", "product": "python-ldap", "versions": [{"status": "affected", "version": "< 3.4.5"}]}]}], "published": "2025-10-10T22:15:37.637", "references": [{"url": "https://github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-170"}]}], "descriptions": [{"lang": "en", "value": "python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue."}, {"lang": "es", "value": "python-ldap es una API cliente de protocolo ligero de acceso a directorios (LDAP) para Python. En versiones anteriores a la 3.4.5, ldap.dn.escape_dn_chars() escapa \\x00 incorrectamente al emitir una barra invertida seguida de un byte NUL literal en lugar de la forma hexadecimal RFC-4514 \\00. Cualquier aplicaci\u00f3n que utilice esta funci\u00f3n auxiliar para construir DNs a partir de entradas no confiables puede hacerse que falle consistentemente antes de que se env\u00ede una solicitud al servidor LDAP (p. ej., AD), lo que resulta en una denegaci\u00f3n de servicio del lado del cliente. La versi\u00f3n 3.4.5 contiene un parche para el problema."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python-ldap:python-ldap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A066CED7-56FF-4B63-80DF-A7959CE54F6A", "versionEndExcluding": "3.4.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}