---
id: CVE-2020-12243
title: >-
  In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with
  nested boolean expressions can result in denial of service (daemon crash).
summary: >-
  In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with
  nested boolean expressions can result in denial of service (daemon crash).
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: openldap
product: openldap
affected:
  - openldap < 2.4.50
  - debian_linux = 8.0
  - debian_linux = 9.0
  - debian_linux = 10.0
  - leap = 15.1
  - ubuntu_linux = 12.04
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.10
  - ubuntu_linux = 20.04
  - cloud_backup
  - steelstore_cloud_integrated_storage
  - h410c_firmware
  - h300s_firmware
  - h500s_firmware
  - h700s_firmware
  - h300e_firmware
  - h500e_firmware
  - h700e_firmware
  - h410s_firmware
  - brocade_fabric_operating_system
  - 'mac_os_x >= 10.13.0, < 10.13.6'
  - 'mac_os_x >= 10.14.0, < 10.14.6'
  - 'mac_os_x >= 10.15, < 10.15.6'
  - mac_os_x = 10.13.6
  - mac_os_x = 10.14.6
  - zfs_storage_appliance_kit = 8.8
  - solaris = 10
  - solaris = 11
patched:
  - openldap 2.4.50
  - mac_os_x 10.15.6
published: '2020-04-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:25.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-12243'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html'
    label: cve@mitre.org
  - url: 'https://bugs.openldap.org/show_bug.cgi?id=9202'
    label: cve@mitre.org
  - url: >-
      https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES
    label: cve@mitre.org
  - url: >-
      https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20200511-0003/'
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT211289'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4352-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4352-2/'
    label: cve@mitre.org
  - url: 'https://www.debian.org/security/2020/dsa-4666'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.openldap.org/show_bug.cgi?id=9202'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200511-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT211289'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4352-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4352-2/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4666'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.04423
epssPercentile: 0.91157
ingestedAt: '2026-10-14T10:25:41.172Z'
---

## Overview

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

## Affected

- `openldap < 2.4.50`
- `debian_linux = 8.0`
- `debian_linux = 9.0`
- `debian_linux = 10.0`
- `leap = 15.1`
- `ubuntu_linux = 12.04`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.10`
- `ubuntu_linux = 20.04`
- `cloud_backup`
- `steelstore_cloud_integrated_storage`
- `h410c_firmware`
- `h300s_firmware`
- `h500s_firmware`
- `h700s_firmware`
- `h300e_firmware`
- `h500e_firmware`
- `h700e_firmware`
- `h410s_firmware`
- `brocade_fabric_operating_system`
- `mac_os_x >= 10.13.0, < 10.13.6`
- `mac_os_x >= 10.14.0, < 10.14.6`
- `mac_os_x >= 10.15, < 10.15.6`
- `mac_os_x = 10.13.6`
- `mac_os_x = 10.14.6`
- `zfs_storage_appliance_kit = 8.8`
- `solaris = 10`
- `solaris = 11`

## Remediation

Upgrade past the affected range:

- `openldap 2.4.50`
- `mac_os_x 10.15.6`