CVE-2025-61911

A sanitization bypass vulnerability has been discovered in python-ldap’s ldap.filter.escape_filter_chars method. When a crafted list or dict object is supplied as the assertion_value parameter with escape_mode=1, the method may skip escaping special characters. This can allow an attacker to inject unescaped special characters into LDAP filters, leading to possible LDAP injection attacks which could disclose or manipulate data.

This issue is rated Moderate severity because exploitation allows unauthorized manipulation or disclosure of LDAP data, but requires the library to be used in a specific manner (escape_mode=1 and supplying a list or dict). Typical deployments using default escape_mode=0 or escape_mode=2 are not exposed to this flaw.

It is important to note that the python-ldap3 package (https://github.com/cannatag/ldap3) is entirely separate and not affected. Only the python-ldap package (https://github.com/python-ldap/python-ldap) contains the vulnerable implementation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

As an interim precaution, avoid using escape_mode=1 unless absolutely required.