Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
ldap3: Unvalidated LDAP Queries Cause Denial of Service
published 6 months ago
Summary
The ldap3 library does not properly check the depth of LDAP queries, which could cause an application that processes these queries to become unresponsive. This issue affects applications that use ldap3 to interact with LDAP servers. To protect your applications, consider upgrading to a newer version of ldap3 or implementing additional query validation.
What to do
- Update firstyear ldap3_proto to version 0.7.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | firstyear | ldap3_proto |
< 0.7.1 Fix: upgrade to 0.7.1
|
Original advisory text
ldap3_proto has LDAP Filter stack exhaustion
### Impact
LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries.
### Workarounds
N/A
### References
Related to GHSA-r5fr-9gmv-jggh
LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries.
### Workarounds
N/A
### References
Related to GHSA-r5fr-9gmv-jggh
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-770Allocation of Resources Without Limits
CWE-674Uncontrolled Recursion
Timeline
Published6 May 2026
Updated14 Aug 2026
First seen7 May 2026
Sources
GHSA-qcxq-75wr-5cm8 · GHSA
Track software like this
Free during beta