CVE-2025-61912

A vulnerability exists in the python-ldap's ldap.dn.escape_dn_chars() helper function, where the null byte (\x00) is improperly escaped by emitting a backslash followed by a literal NUL instead of the required RFC 4514 hex form \00. When this helper is used on untrusted input to build LDAP distinguished names (DNs), it may cause a client-side failure, before any communication with the LDAP server occurs. This results in a client side denial of service (DoS) for parts of the application that rely on the helper for DN construction.

Availability impact is considered Low, as the flaw is limited to denial of service (client-side) only.

It is important to note that the python-ldap3 package (https://github.com/cannatag/ldap3) is entirely separate and not affected. Only the python-ldap package (https://github.com/python-ldap/python-ldap) contains the vulnerable implementation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond these steps.