GHSA-qcxq-75wr-5cm8 ldap3_proto has LDAP Filter stack exhaustion
An attacker can cause a denial of service by sending deeply nested LDAP queries that exhaust the parser stack.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-qcxq-75wr-5cm8?
GHSA-qcxq-75wr-5cm8 is a denial of service vulnerability in ldap3_proto, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This may cause a denial of service in applications that process queries.
Workarounds
N/A
References
Related to GHSA-r5fr-9gmv-jggh
Which versions are affected by GHSA-qcxq-75wr-5cm8?
2 open source packages ship an affected version, including ldap3_proto.
| Package | Affected | Fixed in |
|---|---|---|
ldap3_proto crates.io | All versions | 0.7.1 |
ldap3_proto crates.io | All versions | 0.7.1 |
How do I fix GHSA-qcxq-75wr-5cm8?
Upgrade ldap3_proto to 0.7.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-qcxq-75wr-5cm8 being exploited?
There is no known exploitation of GHSA-qcxq-75wr-5cm8 in the wild and no public exploit code.