ldap3_proto has LDAP Filter stack exhaustion

published 2026-05-06 6mo ago modified 2026-08-14 2mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries.

### Workarounds N/A

### References Related to GHSA-r5fr-9gmv-jggh

Patch / fix

fixed in 1

crates.io ldap3_proto 0.7.1

Is GHSA-qcxq-75wr-5cm8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	ldap3_proto	<0.7.1	0.7.1

Classification

Weakness

CWE-674 Uncontrolled Recursion
CWE-770 Allocation of Resources Without Limits or Throttling

References

github.com /kanidm/ldap3/security/advisories/GHSA-qcxq-75wr-5cm8
web
github.com /advisories/GHSA-r5fr-9gmv-jggh
advisory
github.com /kanidm/ldap3
package

Sources

GitHub Advisory GHSA-qcxq-75wr-5cm8

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.