CVE-2021-46823: Denial of Service in python-ldap
Summary
CVE-2021-46823: Denial of Service in python-ldap. Affects python-ldap versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- python-ldap · Debian:11
The same CVE-2021-46823 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ldap is a Python module that provides an interface to the LDAP protocol. It allows developers to interact with LDAP servers for authentication, querying, and managing directory services. The module is widely used in Python applications that require LDAP integration. However, versions before 3.4.0 are vulnerable to a denial of service (DoS) attack when untrusted schema definitions are used with the ldap.schema module. This vulnerability arises from a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. An attacker with remote authenticated access can exploit this flaw by sending crafted regex input, leading to a DoS condition.
Vulnerability Detail
The vulnerability in python-ldap arises from a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. When untrusted schema definitions are used, an attacker with remote authenticated access can send crafted regex input to trigger the flaw. This can result in a denial of service condition, causing the affected application to become unresponsive. The impact of this vulnerability is limited to the availability of the application and does not allow for arbitrary code execution or privilege escalation.
How To Fix
Latest published version: 3.4.8 as of 22 Oct 2026
pip install --upgrade "python-ldap==3.4.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "python-ldap==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to python-ldap version 3.4.0 or later.
Conclusion
The vulnerability in python-ldap can be mitigated by upgrading to version 3.4.0 or later. It is important for developers to promptly update their dependencies and ensure the use of the fixed version in their applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-ldap →
FAQ
python-ldap is a Python module that provides an interface to the LDAP protocol. It allows developers to interact with LDAP servers for authentication, querying, and managing directory services.
The vulnerability allows a remote authenticated attacker to cause a denial of service condition in the affected application. However, it does not allow for arbitrary code execution or privilege escalation.
To fix this vulnerability, it is recommended to upgrade to python-ldap version 3.4.0 or later.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to python-ldap version 3.4.0 or later.
For more information about this vulnerability, you can refer to the CVE-2021-46823 advisory or the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for python-ldap.
