CVE-2025-61911: python-ldap before 3.4.5 (exclusive), < 3.4.5

Affected technology

python-ldap · before 3.4.5 (exclusive)
python-ldap

python-ldap · < 3.4.5
python-ldap

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says if an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Vendor/CNA’s CVSS 4.0 assessment (base score 5.5/10) rates confidentiality and integrity impact as low; availability impact as none.