CVE-2025-61912 Overview
CVE-2025-61912 affects python-ldap, a Lightweight Directory Access Protocol (LDAP) client API for Python. In versions prior to 3.4.5, the ldap.dn.escape_dn_chars() helper escapes the NUL byte (\\x00) incorrectly. Instead of emitting the RFC-4514 hex form \00, it produces a backslash followed by a literal NUL byte. Applications that build Distinguished Names (DNs) from untrusted input using this helper can be forced to fail before any request reaches the LDAP server, such as Active Directory. The result is a consistent client-side denial of service. Version 3.4.5 contains the patch. This weakness maps to [CWE-116] Improper Encoding or Escaping of Output.
Critical Impact
Attackers who control input passed to escape_dn_chars() can trigger consistent client-side failures that prevent LDAP requests from being issued.
Affected Products
- python-ldap versions prior to 3.4.5
- Applications embedding python-ldap for DN construction from user input
- Downstream tooling depending on ldap.dn.escape_dn_chars() for input sanitization
Discovery Timeline
- 2025-10-10 - CVE-2025-61912 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-61912
Vulnerability Analysis
The ldap.dn.escape_dn_chars() function is designed to escape characters in DN components according to RFC 4514. RFC 4514 requires the NUL byte to be encoded as the two-character hex sequence \00. The vulnerable implementation instead prepends a backslash to the raw NUL byte, producing an invalid DN. Downstream parsing or serialization then rejects the malformed DN before the LDAP client transmits the bind or search request. The application aborts locally, producing a client-side denial of service without ever contacting the directory service.
Root Cause
The root cause is incorrect output encoding in the DN escaping routine. The function fails to substitute the hex representation for \\x00 and instead retains the literal NUL byte in the emitted string. This violates [CWE-116] and produces output that is not a valid RFC 4514 DN string.
Attack Vector
Exploitation requires an attacker to supply a string containing a NUL byte to any code path that passes user input through escape_dn_chars() before DN construction. Typical entry points include login forms, user-provisioning APIs, search filters, and identity synchronization services. No authentication is required when the vulnerable code sits in front of anonymous flows. The impact is limited to availability of the calling application; confidentiality and integrity of directory data are not affected.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-p34h-wq7j-h5v6 for the maintainer's technical description.
Detection Methods for CVE-2025-61912
Indicators of Compromise
- Repeated exceptions or tracebacks originating from ldap.dn or DN parsing routines in application logs
- LDAP client operations failing before any network request is observed on the wire
- Input fields feeding directory operations that contain embedded NUL bytes (\\x00)
Detection Strategies
- Inventory Python environments for installed python-ldap versions below 3.4.5 using pip list or software bill of materials (SBOM) tooling
- Add static analysis rules that flag calls to ldap.dn.escape_dn_chars() on unsanitized input
- Correlate authentication or provisioning failure spikes with the absence of corresponding LDAP traffic to the directory server
Monitoring Recommendations
- Alert on elevated error rates in identity, SSO, and provisioning services that depend on python-ldap
- Monitor application telemetry for exceptions referencing DN encoding or RFC 4514 validation
- Track dependency updates in CI/CD pipelines to confirm upgrades to python-ldap 3.4.5 or later
How to Mitigate CVE-2025-61912
Immediate Actions Required
- Upgrade python-ldap to version 3.4.5 or later in all production and development environments
- Audit application code for any DN construction paths that consume untrusted input
- Reject or strip NUL bytes from user input at the application boundary before passing values to LDAP helpers
Patch Information
The fix is available in python-ldap 3.4.5. Review the GitHub Release Note 3.4.5 and the corrective change in the GitHub Commit Update. Rebuild container images and redeploy services that pin python-ldap in their dependency manifests.
Workarounds
- Filter or reject input containing \\x00 before it reaches escape_dn_chars()
- Wrap DN construction in exception handlers that fail closed and log the offending input for review
- Restrict which application components accept user-supplied identifiers used in DN construction
# Configuration example
pip install --upgrade 'python-ldap>=3.4.5'
pip show python-ldap | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
