CVE-2025-61912: python-ldap Improper Encoding or Escaping of Output

Vulnerability summary

CVE-2025-61912 is a medium (CVSS 5.5) Improper Encoding or Escaping of Output vulnerability in python-ldap. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-10-2025
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.

• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
• CWE-170Improper Null TerminationThe product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.