{"id":"AZL-68433","summary":"CVE-2025-61912 affecting package python-ldap 3.4.4-1","details":"python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \\x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \\00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.","modified":"2026-04-21T04:38:24.803415Z","published":"2025-10-10T22:15:37Z","upstream":["CVE-2025-61912"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61912"}],"affected":[{"package":{"name":"python-ldap","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-ldap"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.4-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-68433.json"}}],"schema_version":"1.7.5"}