Regular Expression Denial-of-Service (ReDoS) in python-ldap
Summary
GHSA-r8wq-qrxc-hmcm: ReDoS in LDAP schema parser. Affects python-ldap versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ldap is a Python module that provides an interface to the LDAP (Lightweight Directory Access Protocol) protocol. It allows Python programs to access and manipulate LDAP directories. The module includes a schema parser, which is responsible for parsing LDAP schema definitions. However, versions 3.3.1 and earlier of python-ldap are vulnerable to a regular expression denial-of-service (ReDoS) attack when parsing LDAP schema definitions from untrusted sources.
Vulnerability Detail
The vulnerability in python-ldap's schema parser arises from a lack of input validation. An attacker can craft a malicious LDAP schema definition with excessive backslashes, causing the parser to enter a state of exponential backtracking when attempting to match the input against a regular expression. This can lead to a denial-of-service condition, where the parsing process consumes excessive CPU resources and causes the program to become unresponsive. Clients that use the ldap.schema package to parse LDAP schema definitions from untrusted sources are affected by this vulnerability.
How To Fix
Latest published version: 3.4.8 as of 22 Oct 2026
pip install --upgrade "python-ldap==3.4.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "python-ldap==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually check the input for an excessive number of backslashes in LDAP schema definitions. If a schema definition contains more than a dozen backslashes per line, it is likely to be atypical and may indicate a malicious attempt. In such cases, the schema definition should be treated with caution or rejected.
Conclusion
The vulnerability in python-ldap's schema parser can be exploited through a regular expression denial-of-service (ReDoS) attack. To mitigate the risk, users should update their python-ldap installation to version 3.4.0 or later once it becomes available. In the meantime, caution should be exercised when parsing LDAP schema definitions from untrusted sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-ldap →
FAQ
python-ldap is a Python module that provides an interface to the LDAP protocol, allowing Python programs to access and manipulate LDAP directories.
A regular expression denial-of-service (ReDoS) attack is a type of denial-of-service attack that exploits the exponential time complexity of certain regular expressions. By crafting a malicious input that triggers excessive backtracking in the regular expression engine, an attacker can cause the program to consume excessive CPU resources and become unresponsive.
Versions 3.3.1 and earlier of python-ldap are vulnerable to the regular expression denial-of-service (ReDoS) attack when parsing LDAP schema definitions.
To mitigate the vulnerability, it is recommended to update python-ldap to version 3.4.0 or later once it becomes available. In the meantime, users can manually check LDAP schema definitions for an excessive number of backslashes as a temporary workaround.
Yes, the CVSS score for this vulnerability is 6.5 (Medium severity).
References
Related vulnerabilities
Recent vulnerabilities recorded for python-ldap.
