{"id":"GHSA-qcxq-75wr-5cm8","title":"ldap3_proto has LDAP Filter stack exhaustion","summary":"ldap3_proto has LDAP Filter stack exhaustion","severity":"high","vendor":"ldap3_proto","product":"ldap3_proto","ecosystem":"rust","affected":["ldap3_proto < 0.7.1"],"patched":["ldap3_proto 0.7.1"],"published":"2026-05-06","updated":"2026-08-14","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qcxq-75wr-5cm8","references":[{"url":"https://github.com/kanidm/ldap3/security/advisories/GHSA-qcxq-75wr-5cm8"},{"url":"https://github.com/advisories/GHSA-r5fr-9gmv-jggh"},{"url":"https://github.com/kanidm/ldap3"}],"tags":["osv","rust"],"ingestedAt":"2026-08-15T19:19:54.494Z","slug":"GHSA-qcxq-75wr-5cm8","body":"## Overview\n\n### Impact\nLDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries.\n\n### Workarounds\nN/A\n\n### References\nRelated to GHSA-r5fr-9gmv-jggh\n\n## Affected packages\n\n- `ldap3_proto < 0.7.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ldap3_proto 0.7.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}