python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20421-1 advisory.

    - CVE-2025-61911: Enforce str for escape_filter_chars (bsc#1251912).
    - CVE-2025-61912: Escape NULs as per RFC 4514 in escape_dn_chars (bsc#1251913).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-ldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of     special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the     non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3     different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a     `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes     without performing adequate logic to ensure a fully escaped return value. If an application relies on the     vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able     to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate     ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the     start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied     `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal     NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from     untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD),     resulting in a client-side denial of service. Version 3.4.5 contains a patch for the     issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal     NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from     untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD),     resulting in a client-side denial of service. Version 3.4.5 contains a patch for the     issue.(CVE-2025-61912)

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of     special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the     non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3     different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a     `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes     without performing adequate logic to ensure a fully escaped return value. If an application relies on the     vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able     to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate     ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the     start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied     `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of     special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the     non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3     different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a     `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes     without performing adequate logic to ensure a fully escaped return value. If an application relies on the     vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able     to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate     ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the     start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied     `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal     NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from     untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD),     resulting in a client-side denial of service. Version 3.4.5 contains a patch for the     issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-ldap installed on the remote host is prior to 2.4.15-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3058 advisory.

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal     NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from     untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD),     resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
    (CVE-2025-61912)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0845 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-61912:
    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal     NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from     untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD),     resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.

    CVE-2025-61911:
    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of     special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the     non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3     different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a     `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes     without performing adequate logic to ensure a fully escaped return value. If an application relies on the     vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able     to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate     ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the     start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied     `assertion_value` parameter is not of type `str`.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7828-1 advisory.

    It was discovered that Python LDAP incorrectly handled special characters in the special character     filtering function. A remote attacker could possibly use this issue to perform LDAP injection attacks.
    (CVE-2025-61911)

    Arad Inbar discovered that Python LDAP incorrectly escaped NUL character bytes. An attacker could possibly     use this issue to cause a denial of service. (CVE-2025-61912)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to     3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal     NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from     untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD),     resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
    (CVE-2025-61912)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304222	openSUSE 16 Security Update : python-ldap (openSUSE-SU-2026:20421-1)	Nessus	SuSE Local Security Checks	medium
302704	EulerOS Virtualization 2.10.0 : python-ldap (EulerOS-SA-2026-1563)	Nessus	Huawei Local Security Checks	medium
302694	EulerOS Virtualization 2.12.1 : python-ldap (EulerOS-SA-2026-1456)	Nessus	Huawei Local Security Checks	medium
302571	EulerOS 2.0 SP11 : python-ldap (EulerOS-SA-2026-1617)	Nessus	Huawei Local Security Checks	medium
302567	EulerOS 2.0 SP11 : python-ldap (EulerOS-SA-2026-1589)	Nessus	Huawei Local Security Checks	medium
302561	EulerOS Virtualization 2.10.1 : python-ldap (EulerOS-SA-2026-1543)	Nessus	Huawei Local Security Checks	medium
302464	EulerOS 2.0 SP12 : python-ldap (EulerOS-SA-2026-1377)	Nessus	Huawei Local Security Checks	medium
302450	EulerOS 2.0 SP10 : python-ldap (EulerOS-SA-2026-1346)	Nessus	Huawei Local Security Checks	medium
302396	EulerOS 2.0 SP12 : python-ldap (EulerOS-SA-2026-1408)	Nessus	Huawei Local Security Checks	medium
302377	EulerOS 2.0 SP10 : python-ldap (EulerOS-SA-2026-1320)	Nessus	Huawei Local Security Checks	medium
281588	EulerOS Virtualization 2.13.0 : python-ldap (EulerOS-SA-2025-2615)	Nessus	Huawei Local Security Checks	medium
281577	EulerOS Virtualization 2.13.1 : python-ldap (EulerOS-SA-2025-2629)	Nessus	Huawei Local Security Checks	medium
278424	EulerOS 2.0 SP13 : python-ldap (EulerOS-SA-2025-2530)	Nessus	Huawei Local Security Checks	medium
278416	EulerOS 2.0 SP13 : python-ldap (EulerOS-SA-2025-2509)	Nessus	Huawei Local Security Checks	medium
274643	Amazon Linux 2 : python-ldap, --advisory ALAS2-2025-3058 (ALAS-2025-3058)	Nessus	Amazon Linux Local Security Checks	medium
272252	TencentOS Server 4: python-ldap (TSSA-2025:0845)	Nessus	Tencent Local Security Checks	medium
270871	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Python LDAP vulnerabilities (USN-7828-1)	Nessus	Ubuntu Local Security Checks	medium
270276	Linux Distros Unpatched Vulnerability : CVE-2025-61912	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-61912

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium