PT-2025-41610 · Pypi+4 · Python-Ldap+4

Aradona91 · Published 2025-10-10 · Updated 2026-03-25 · CVE-2025-61912

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-ldap versions prior to 3.4.5

Description python-ldap is a lightweight directory access protocol (LDAP) client API for Python. The ldap.dn.escape dn chars() function incorrectly escapes x00 by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form 00. This can cause applications using this helper to construct Distinguished Names (DNs) from untrusted input to fail before a request is sent to the LDAP server, resulting in a client-side denial of service.

Recommendations Update to python-ldap version 3.4.5 or later.

Exploit

Fix

DoS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-170

Related Identifiers

AZL-68433

AZL-68454

BDU:2026-02915

CVE-2025-61912

GHSA-P34H-WQ7J-H5V6

OESA-2025-2681

OESA-2025-2682

OESA-2025-2684

OESA-2025-2685

OESA-2025-2686

OESA-2026-1248

OPENSUSE-SU-2025:15637-1

OPENSUSE-SU-2026:20421-1

SUSE-SU-2025:3695-1

SUSE-SU-2025:3714-1

SUSE-SU-2026:20933-1

USN-7828-1

Affected Products

Debian

Linuxmint

Red Os

Ubuntu

Python-Ldap

References · 62

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61912.json · Exploit
• 🔥 https://github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6 · Exploit
• https://github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f · Patch
• https://osv.dev/vulnerability/OESA-2025-2682 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61911 · Security Note
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7828-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2684 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3714-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1248 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61912 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20933-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory