CVE-2025-61912: python-ldap Denial of Service via Improper Null Termination
Summary
CVE-2025-61912: python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination. Affects python-ldap versions < 3.4.5. Fixed in 3.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ldap is a popular library for interacting with LDAP (Lightweight Directory Access Protocol) servers in Python applications. It provides a range of functionalities for LDAP operations, including user management and directory queries. However, the library has a vulnerability that affects its ability to properly escape certain characters, specifically the null byte, which can lead to client-side denial of service.
Vulnerability Detail
The vulnerability arises from the function ldap.dn.escape_dn_chars(), which incorrectly escapes the null byte ('\x00') by emitting a backslash followed by a literal NUL byte instead of the correct RFC-4514 hex form ('\00'). This flaw can cause applications that rely on this function to construct Distinguished Names (DNs) from untrusted input to fail consistently before any request is sent to the LDAP server. The improper handling of null bytes can lead to exceptions and crashes in client applications, resulting in a denial of service. This is particularly concerning for applications that allow user input for DN construction, as a single crafted input containing a null byte can disrupt workflows and lead to unhandled exceptions.
How To Fix
Latest published version: 3.4.8 as of 22 Oct 2026
pip install --upgrade "python-ldap==3.4.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.5
This is the first release that contains the fix.
pip install --upgrade "python-ldap==3.4.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can implement a temporary workaround by manually replacing null bytes in your input before passing it to the escape_dn_chars function. Here is an example code snippet:
input_value = "user\0name"
# Replace null bytes with RFC-4514 compliant escape
safe_value = input_value.replace('\x00', r'\00')
# Now use safe_value for DN construction
Conclusion
The CVE-2025-61912 vulnerability in python-ldap poses a significant risk of denial of service due to improper null termination in DN construction. It is crucial for developers to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for python-ldap →
FAQ
CVE-2025-61912 is a vulnerability in the python-ldap library that can lead to client-side denial of service due to improper handling of null bytes in Distinguished Names.
If your application uses python-ldap to construct DNs from untrusted input, it may crash or throw exceptions when encountering null bytes, disrupting normal operations.
You can implement a temporary workaround by manually escaping null bytes in your input before using the escape_dn_chars function.
You can find detailed information about CVE-2025-61912 in the advisory database on GitHub or by visiting the official python-ldap documentation.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. With Vulert Playground, you can check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-ldap.
