{"id":"CVE-2025-61911","aliases":["ALPINE-CVE-2025-61911","AZL-68430","AZL-68451","DEBIAN-CVE-2025-61911","EUVD-2025-33797","GHSA-r7r6-cc7p-4v5m","OESA-2025-2681","OESA-2025-2682","OESA-2025-2683","OESA-2025-2684","OESA-2025-2685","OESA-2025-2686","PYSEC-2026-1847","SUSE-SU-2025:3695-1","SUSE-SU-2025:3714-1","SUSE-SU-2026:20933-1","UBUNTU-CVE-2025-61911","USN-7828-1","openSUSE-SU-2025:15637-1","openSUSE-SU-2026:20421-1"],"status":"published","title":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.25589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-75","CWE-843"],"published":"2025-10-10T22:02:15Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"python-ldap","fixed_in":["3.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-ldap","fixed_in":["3.4.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-ldap","fixed_in":["3.4.3-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-ldap","fixed_in":["3.4.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-ldap","fixed_in":["3.4.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-ldap","fixed_in":["3.4.4-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-ldap","fixed_in":["2.4.22-0.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-ldap","fixed_in":["3.0.0-1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-ldap","fixed_in":["3.2.0-4ubuntu2.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-ldap","fixed_in":["3.2.0-4ubuntu7.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-ldap","fixed_in":["3.4.4-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-ldap","fixed_in":["3.4.4-1ubuntu0.25.10.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-2+deb12u1"}]}],"versions":["3.4.3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1+deb13u1"}]}],"versions":["3.4.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1"}]}],"versions":["3.4.4-1","3.4.4-2"]},{"source":"osv","ecosystem":"PyPI","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5"}]}],"versions":["2.3.13","2.4.0","2.4.1","2.4.10","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.21","2.4.22","2.4.25","2.4.26","2.4.27","2.4.28","2.4.29","2.4.3","2.4.30","2.4.31","2.4.32","2.4.33","2.4.35","2.4.36","2.4.37","2.4.38","2.4.39","2.4.4","2.4.40","2.4.41","2.4.42","2.4.43","2.4.44","2.4.45","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.1","2.5.2","3.0.0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.1.0","3.2.0","3.3.0","3.3.1","3.4.0","3.4.2","3.4.3","3.4.4"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-7.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-3.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-3.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-6.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-7.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5"}]}],"versions":["2.3.13","2.4.0","2.4.1","2.4.10","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.21","2.4.22","2.4.25","2.4.26","2.4.27","2.4.28","2.4.29","2.4.3","2.4.30","2.4.31","2.4.32","2.4.33","2.4.35","2.4.36","2.4.37","2.4.38","2.4.39","2.4.4","2.4.40","2.4.41","2.4.42","2.4.43","2.4.44","2.4.45","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.1","2.5.2","3.0.0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.1.0","3.2.0","3.3.0","3.3.1","3.4.0","3.4.2","3.4.3","3.4.4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150100.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-0.1ubuntu0.1~esm1"}]}],"versions":["2.4.20-0.1","2.4.22-0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1ubuntu0.2+esm1"}]}],"versions":["2.4.41-1","2.5.2-1","3.0.0~b4-1","3.0.0-1","3.0.0-1ubuntu0.1","3.0.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-4ubuntu2.1+esm1"}]}],"versions":["3.1.0-2build1","3.1.0-2build2","3.2.0-3","3.2.0-3ubuntu1","3.2.0-3ubuntu2","3.2.0-3ubuntu3","3.2.0-4ubuntu2","3.2.0-4ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-4ubuntu7.2"}]}],"versions":["3.2.0-4ubuntu5","3.2.0-4ubuntu6","3.2.0-4ubuntu7","3.2.0-4ubuntu7.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1ubuntu0.24.04.1"}]}],"versions":["3.4.3-2build2","3.4.3-2build3","3.4.3-2ubuntu1","3.4.4-1","3.4.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1ubuntu0.25.10.1"}]}],"versions":["3.4.4-1build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-0.1ubuntu0.1~esm1"}]}],"versions":["2.4.20-0.1","2.4.22-0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1ubuntu0.2+esm1"}]}],"versions":["2.4.41-1","2.5.2-1","3.0.0~b4-1","3.0.0-1","3.0.0-1ubuntu0.1","3.0.0-1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-4ubuntu2.1+esm1"}]}],"versions":["3.1.0-2build1","3.1.0-2build2","3.2.0-3","3.2.0-3ubuntu1","3.2.0-3ubuntu2","3.2.0-3ubuntu3","3.2.0-4ubuntu2","3.2.0-4ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-4ubuntu7.2"}]}],"versions":["3.2.0-4ubuntu5","3.2.0-4ubuntu6","3.2.0-4ubuntu7","3.2.0-4ubuntu7.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1ubuntu0.24.04.1"}]}],"versions":["3.4.3-2build2","3.4.3-2build3","3.4.3-2ubuntu1","3.4.4-1","3.4.4-1build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1ubuntu0.25.10.1"}]}],"versions":["3.4.4-1build3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"python-ldap","product":"python-ldap"}],"references":[{"url":"https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r7r6-cc7p-4v5m","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/python-ldap/python-ldap/commit/3957526fb1852e84b90f423d9fef34c7af25b85a","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61911","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r7r6-cc7p-4v5m","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-61911","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61911.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-61911","tags":["advisory"]},{"url":"https://github.com/python-ldap/python-ldap","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61912","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2682","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2683","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2684","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2685","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2686","tags":["advisory"]},{"url":"https://pypi.org/project/python-ldap","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253695-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251912","tags":["report"]},{"url":"https://bugzilla.suse.com/1251913","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61912","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253714-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620933-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-61911","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61911","tags":["report"]},{"url":"https://github.com/python-ldap/python-ldap/commit/464fddacd63092d6e01c62a38316a713c30ca98a","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7828-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-61912","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61911","title":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:02:15.529Z","modified":"2025-10-14T14:57:34.174Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-75","CWE-843"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-33797","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:02:15Z","modified":"2025-10-14T14:57:34Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T20:31:33.01309Z"}],"ghsa":[{"id":"GHSA-r7r6-cc7p-4v5m","title":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","description":"### Summary\nThe sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured.\n\n### Details\nThe method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` happily computes without performing adequate logic to ensure a fully escaped return value.\n\n### PoC\n```\n\u003e\u003e\u003e import ldap.filter\n```\n**Exploitable**\n```\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=1)\n'abc@*()/xyz'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars({\"abc@*()/xyz\": 1}, escape_mode=1)\n'abc@*()/xyz'\n```\n**Not exploitable**\n```\n\u003e\u003e\u003e ldap.filter.escape_filter_chars(\"abc@*()/xyz\", escape_mode=1)\n'abc@\\\\2a\\\\28\\\\29\\\\2fxyz'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=0)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 41, in escape_filter_chars\n    s = assertion_value.replace('\\\\', r'\\5c')\n        ^^^^^^^^^^^^^^^^^^^^^^^\nAttributeError: 'list' object has no attribute 'replace'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=2)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 36, in escape_filter_chars\n    r.append(\"\\\\%02x\" % ord(c))\n                        ^^^^^^\nTypeError: ord() expected a character, but string of length 11 found\n```\n### Impact\nIf an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them.\n\nWith Python being a dynamically typed language, and the commonly used `JSON` format supporting `list` and `dict`, it is to be expected that Python applications may commonly forward unchecked and potentially malicious `list` and `dict` objects to the vulnerable sanitization method.\n\nThe vulnerable `escape_mode=1` configuration does not appear to be widely used.\n\n### Suggested Fix\nAdd a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:51:28Z","modified":"2025-10-13T15:47:37Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-75","CWE-843"],"updated_at":"2026-11-02T14:39:00.807341Z"}],"nvd":[{"id":"CVE-2025-61911","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:15:37.47Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-75","CWE-843"],"updated_at":"2026-11-02T14:11:36.851295Z"}],"osv":[{"id":"ALPINE-CVE-2025-61911","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:15:37.47Z","modified":"2026-11-03T06:33:01.008455276Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-61911","title":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:02:15.529Z","modified":"2026-10-28T02:30:50.47291654Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-75","CWE-843"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-61911","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:15:37.47Z","modified":"2026-10-23T17:47:28.92842846Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-r7r6-cc7p-4v5m","title":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","description":"### Summary\nThe sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured.\n\n### Details\nThe method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` happily computes without performing adequate logic to ensure a fully escaped return value.\n\n### PoC\n```\n\u003e\u003e\u003e import ldap.filter\n```\n**Exploitable**\n```\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=1)\n'abc@*()/xyz'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars({\"abc@*()/xyz\": 1}, escape_mode=1)\n'abc@*()/xyz'\n```\n**Not exploitable**\n```\n\u003e\u003e\u003e ldap.filter.escape_filter_chars(\"abc@*()/xyz\", escape_mode=1)\n'abc@\\\\2a\\\\28\\\\29\\\\2fxyz'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=0)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 41, in escape_filter_chars\n    s = assertion_value.replace('\\\\', r'\\5c')\n        ^^^^^^^^^^^^^^^^^^^^^^^\nAttributeError: 'list' object has no attribute 'replace'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=2)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 36, in escape_filter_chars\n    r.append(\"\\\\%02x\" % ord(c))\n                        ^^^^^^\nTypeError: ord() expected a character, but string of length 11 found\n```\n### Impact\nIf an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them.\n\nWith Python being a dynamically typed language, and the commonly used `JSON` format supporting `list` and `dict`, it is to be expected that Python applications may commonly forward unchecked and potentially malicious `list` and `dict` objects to the vulnerable sanitization method.\n\nThe vulnerable `escape_mode=1` configuration does not appear to be widely used.\n\n### Suggested Fix\nAdd a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:51:28Z","modified":"2026-09-10T03:50:30.344217241Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-75","CWE-843"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"OESA-2025-2681","title":"python-ldap security update","description":"python-ldap:   python-ldap provides an object-oriented API to access LDAP directory servers   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.   Additionally the package contains modules for other LDAP-related stuff   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations   and controls, etc.).\r\n\r\nSecurity Fix(es):\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)","status":"published","published":"2025-11-14T11:09:48Z","modified":"2026-08-18T01:19:19.540526295Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2682","title":"python-ldap security update","description":"python-ldap:   python-ldap provides an object-oriented API to access LDAP directory servers   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.   Additionally the package contains modules for other LDAP-related stuff   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations   and controls, etc.).\r\n\r\nSecurity Fix(es):\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)","status":"published","published":"2025-11-14T11:09:48Z","modified":"2026-08-18T01:19:19.368646521Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2683","title":"python-ldap security update","description":"python-ldap:   python-ldap provides an object-oriented API to access LDAP directory servers   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.   Additionally the package contains modules for other LDAP-related stuff   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations   and controls, etc.).\r\n\r\nSecurity Fix(es):\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)","status":"published","published":"2025-11-14T11:09:48Z","modified":"2026-08-18T01:19:18.905271835Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2684","title":"python-ldap security update","description":"python-ldap:   python-ldap provides an object-oriented API to access LDAP directory servers   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.   Additionally the package contains modules for other LDAP-related stuff   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations   and controls, etc.).\r\n\r\nSecurity Fix(es):\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)","status":"published","published":"2025-11-14T11:09:48Z","modified":"2026-08-18T01:19:18.893106844Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2685","title":"python-ldap security update","description":"python-ldap:   python-ldap provides an object-oriented API to access LDAP directory servers   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.   Additionally the package contains modules for other LDAP-related stuff   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations   and controls, etc.).\r\n\r\nSecurity Fix(es):\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)","status":"published","published":"2025-11-14T11:09:48Z","modified":"2026-08-18T01:19:19.222369388Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2686","title":"python-ldap security update","description":"python-ldap:   python-ldap provides an object-oriented API to access LDAP directory servers   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.   Additionally the package contains modules for other LDAP-related stuff   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations   and controls, etc.).\r\n\r\nSecurity Fix(es):\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)\n\npython-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)","status":"published","published":"2025-11-14T11:09:48Z","modified":"2026-08-18T01:19:19.784388932Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1847","title":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","description":"### Summary\nThe sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured.\n\n### Details\nThe method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` happily computes without performing adequate logic to ensure a fully escaped return value.\n\n### PoC\n```\n\u003e\u003e\u003e import ldap.filter\n```\n**Exploitable**\n```\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=1)\n'abc@*()/xyz'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars({\"abc@*()/xyz\": 1}, escape_mode=1)\n'abc@*()/xyz'\n```\n**Not exploitable**\n```\n\u003e\u003e\u003e ldap.filter.escape_filter_chars(\"abc@*()/xyz\", escape_mode=1)\n'abc@\\\\2a\\\\28\\\\29\\\\2fxyz'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=0)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 41, in escape_filter_chars\n    s = assertion_value.replace('\\\\', r'\\5c')\n        ^^^^^^^^^^^^^^^^^^^^^^^\nAttributeError: 'list' object has no attribute 'replace'\n\u003e\u003e\u003e ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=2)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 36, in escape_filter_chars\n    r.append(\"\\\\%02x\" % ord(c))\n                        ^^^^^^\nTypeError: ord() expected a character, but string of length 11 found\n```\n### Impact\nIf an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them.\n\nWith Python being a dynamically typed language, and the commonly used `JSON` format supporting `list` and `dict`, it is to be expected that Python applications may commonly forward unchecked and potentially malicious `list` and `dict` objects to the vulnerable sanitization method.\n\nThe vulnerable `escape_mode=1` configuration does not appear to be widely used.\n\n### Suggested Fix\nAdd a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2026-07-07T16:03:07.412593Z","modified":"2026-07-07T17:47:51.799608944Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2025-61911","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:15:00Z","modified":"2026-02-05T05:25:39.426343Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"AZL-68430","title":"CVE-2025-61911 affecting package python-ldap 3.4.4-1","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:15:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.994498Z"},{"id":"AZL-68451","title":"CVE-2025-61911 affecting package python-ldap 3.4.0-1","description":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","status":"published","published":"2025-10-10T22:15:37Z","modified":"2026-04-21T04:38:25.091698Z","updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"openSUSE-SU-2025:15637-1","title":"python311-ldap-3.4.5-1.1 on GA media","description":"These are all security issues fixed in the python311-ldap-3.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-15T00:00:00Z","modified":"2026-03-23T04:54:02.22075Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20421-1","title":"Security update for python-ldap","description":"This update for python-ldap fixes the following issues:\n\n- CVE-2025-61911: Enforce str for escape_filter_chars (bsc#1251912).\n- CVE-2025-61912: Escape NULs as per RFC 4514 in escape_dn_chars (bsc#1251913).\n","status":"published","published":"2026-03-25T10:40:32Z","modified":"2026-03-29T17:26:37.696599Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:3695-1","title":"Security update for python-ldap","description":"This update for python-ldap fixes the following issues:\n\n- CVE-2025-61911: Enforce str for escape_filter_chars (bsc#1251912).\n- CVE-2025-61912: Escape NULs as per RFC 4514 in escape_dn_chars (bsc#1251913).\n","status":"published","published":"2025-10-21T06:18:00Z","modified":"2026-02-04T03:07:43.336993Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3714-1","title":"Security update for python-ldap","description":"This update for python-ldap fixes the following issues:\n\n- CVE-2025-61911: Enforce str for escape_filter_chars (bsc#1251912).\n- CVE-2025-61912: Escape NULs as per RFC 4514 in escape_dn_chars (bsc#1251913).\n","status":"published","published":"2025-10-22T07:10:58Z","modified":"2026-02-04T03:48:02.183252Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20933-1","title":"Security update for python-ldap","description":"This update for python-ldap fixes the following issues:\n\n- CVE-2025-61911: Enforce str for escape_filter_chars (bsc#1251912).\n- CVE-2025-61912: Escape NULs as per RFC 4514 in escape_dn_chars (bsc#1251913).\n","status":"published","published":"2026-03-25T10:48:13Z","modified":"2026-04-02T17:24:47.759316Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-7828-1","title":"python-ldap vulnerabilities","description":"It was discovered that Python LDAP incorrectly handled special characters\nin the special character filtering function. A remote attacker could\npossibly use this issue to perform LDAP injection attacks.\n(CVE-2025-61911)\n\nArad Inbar discovered that Python LDAP incorrectly escaped NUL character\nbytes. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2025-61912)","status":"published","published":"2025-10-20T12:41:40Z","modified":"2026-06-25T13:32:31.198505469Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}