CVE-2025-61911: python-ldap Sanitization Bypass Vulnerability
Summary
CVE-2025-61911: python-ldap has sanitization bypass in ldap.filter.escape_filter_chars. Affects python-ldap versions < 3.4.5. Fixed in 3.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ldap is a popular library in Python that provides an interface to interact with LDAP (Lightweight Directory Access Protocol) directories. It allows developers to perform operations such as searching, adding, and modifying entries in an LDAP directory. The library is widely used in applications that require user authentication and directory services. However, it has a vulnerability in its sanitization method that can lead to LDAP injection attacks if untrusted user input is not properly handled.
Vulnerability Detail
The vulnerability arises from the method ldap.filter.escape_filter_chars, which is designed to escape special characters in LDAP filter strings. When the escape_mode parameter is set to 1, the method fails to properly escape characters if a crafted list or dictionary is provided as the assertion_value. This can allow an attacker to bypass the intended sanitization and potentially execute LDAP injection attacks, leading to unauthorized access or manipulation of LDAP data. The issue is particularly concerning because Python's dynamic typing and the common use of JSON format can lead to unchecked and malicious inputs being passed to this method.
How To Fix
Latest published version: 3.4.8 as of 22 Oct 2026
pip install --upgrade "python-ldap==3.4.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.5
This is the first release that contains the fix.
pip install --upgrade "python-ldap==3.4.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a type check in your application code before calling the ldap.filter.escape_filter_chars method. Ensure that the assertion_value parameter is of type str. For example:
if isinstance(assertion_value, str): escaped_value = ldap.filter.escape_filter_chars(assertion_value, escape_mode=1) else: raise ValueError('assertion_value must be a string')
Conclusion
The CVE-2025-61911 vulnerability in the python-ldap library poses a significant risk due to its potential for LDAP injection attacks. It is crucial for developers using this library to update to the patched version and implement necessary checks to safeguard against exploitation.
See every vulnerability recorded for python-ldap →
FAQ
CVE-2025-61911 is a vulnerability in the python-ldap library that allows for a sanitization bypass, potentially leading to LDAP injection attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
If exploited, this vulnerability can allow attackers to manipulate or access LDAP data that should be protected, leading to unauthorized access or data breaches.
If an immediate update is not possible, implement a type check in your code to ensure that only strings are passed to the escape_filter_chars method.
Yes, the vulnerability has been patched in version 3.4.5 of the python-ldap library. It is recommended to upgrade to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-ldap.
