ldap3_proto LDAP filter stack exhaustion denial of service

Executive brief

ldap3_proto is a Rust library used to parse and process LDAP queries. The library does not validate the depth of LDAP filter queries, allowing an attacker to craft deeply nested queries that exhaust the parser's stack memory. Applications using this library to process untrusted LDAP queries can be caused to crash, resulting in a denial of service.

Technical details

The vulnerability is an uncontrolled recursion issue (CWE-674) in the ldap3_proto Rust library's LDAP filter parser. Both the PEG and ASN.1 parsers fail to enforce limits on query nesting depth, allowing an attacker to send a specially crafted LDAP query with excessive recursion depth. When the parser processes such a query, it exhausts the stack, triggering a denial of service condition. The attack requires network access to an application using the vulnerable library versions prior to 0.7.1, no authentication, and no user interaction. The patch is available in version 0.7.1, which introduces depth validation in the parser.

Affected products

• kanidm ldap3_proto < 0.7.1

Timeline

• 2026-04-30: disclosed: Advisory published by GitHub
• 2026-04-30: patched: Fix released in version 0.7.1

References

• https://api.github.com/users/mbarbero
• https://github.com/mbarbero
• https://api.github.com/users/mbarbero/gists%7B/gist_id%7D
• https://api.github.com/users/mbarbero/repos
• https://avatars.githubusercontent.com/u/452625?v=4
• https://api.github.com/users/mbarbero/events%7B/privacy%7D