CVE-2025-61912 python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
Improper escaping of null bytes in python-ldap allows attackers to cause client-side denial of service by triggering consistent failures before LDAP requests are sent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61912?
CVE-2025-61912 is a medium-severity denial of service vulnerability in python-ldap, published on 10 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
Which versions are affected by CVE-2025-61912?
3 open source packages ship an affected version, including python-ldap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-ldap PyPI | All versions | 3.4.5 |
python-ldap PyPI | All versions | 3.4.5 |
python-ldap PyPI | All versions | 3.4.5 |
Products include Python-Ldap Python-Ldap.
How do I fix CVE-2025-61912?
Upgrade python-ldap to 3.4.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61912 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61912 exists.
Other vulnerabilities in python-ldap
Sources
Also known as AZL-68433, AZL-68454, DEBIAN-CVE-2025-61912, ECHO-daef-217d-eb9d, GHSA-p34h-wq7j-h5v6, OESA-2026-1248 and 2 more.