LDAP Injection Vulnerability in Python LDAP Client API by python-ldap

CVE-2025-61911

What is CVE-2025-61911?

The python-ldap library, a popular LDAP client API for Python, has a vulnerability in its sanitization method ldap.filter.escape_filter_chars. In versions before 3.4.5, an attacker can exploit this flaw when providing a crafted list or dictionary as the assertion_value parameter while using non-default escape_mode=1. Unlike other modes that raise exceptions for such inputs, escape_mode=1 neglects these checks, enabling an attacker to launch LDAP injection attacks. This can lead to unauthorized disclosure or manipulation of sensitive LDAP data. Version 3.4.5 addresses this issue by adding necessary type checks to prevent the exploitation of this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References