CVE-2025-61912: python-ldap Denial of Service Due to Improper Encoding of Output
Summary
CVE-2025-61912: python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination. Affects python-ldap versions < 3.4.5. Fixed in 3.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-ldap is a widely used library in Python for interacting with LDAP (Lightweight Directory Access Protocol) servers. It provides functionalities for querying and modifying directory services, making it essential for applications that require user authentication and directory management. However, it has a vulnerability that affects its ability to handle certain inputs safely, particularly when constructing Distinguished Names (DNs) from untrusted data.
Vulnerability Detail
The vulnerability arises from the function ldap.dn.escape_dn_chars(), which incorrectly escapes the NUL byte ('\x00'). Instead of using the proper RFC-4514 hex encoding ('\00'), it emits a backslash followed by a literal NUL byte. This leads to client-side denial of service as any application relying on this function to build DNs from untrusted input can fail before reaching the LDAP server. The incorrect handling of the NUL byte can cause exceptions or crashes, disrupting workflows and potentially leading to service outages.
How To Fix
Latest published version: 3.4.8 as of 22 Oct 2026
pip install --upgrade "python-ldap==3.4.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.5
This is the first release that contains the fix.
pip install --upgrade "python-ldap==3.4.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually replace NUL bytes in your input before passing it to the escape_dn_chars function. Here is an example of how to do this in Python:
cn = "bad\0name"
escaped_cn = escape_dn_chars(cn.replace('\x00', r'\00'))
dn = f"CN={escaped_cn},OU=Users,DC=dsec,DC=local"
Conclusion
The python-ldap library has a vulnerability that can lead to client-side denial of service due to improper handling of NUL bytes in Distinguished Names. It is crucial to update to the patched version or implement workarounds to ensure application stability and security.
See every vulnerability recorded for python-ldap →
FAQ
The vulnerability can lead to client-side denial of service, causing applications to crash or fail when processing certain inputs.
Any application that uses ldap.dn.escape_dn_chars() to construct DNs from untrusted input is at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
If an immediate update is not possible, implement the provided workaround to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-ldap.
