GitHub Advisoryadvisory · crates.io

GHSA-qcxq-75wr-5cm8 ldap3_proto has LDAP Filter stack exhaustion

HIGH Published 2026-05-06 Modified 2026-08-14 Official page ↗
Ecosystem
crates.io
Packages
ldap3_proto
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-674, CWE-770
Reviewed
2026-05-06

Affected packages

• crates.io ldap3_proto: < 0.7.1 → fixed in 0.7.1

Description

Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries. Workarounds N/A References Related to GHSA-r5fr-9gmv-jggh

Related

Weakness · CWE (2)

  • CWE-674 Uncontrolled Recursion weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References