---
id: CVE-2021-46823
aliases:
  - GHSA-qfr5-wjpw-q4c4
  - GHSA-r8wq-qrxc-hmcm
  - PYSEC-2026-912
title: Denial of Service in python-ldap
summary: Denial of Service in python-ldap
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: python-ldap
product: python-ldap
ecosystem: pip
affected:
  - python-ldap < 3.4.0
patched:
  - python-ldap 3.4.0
published: '2022-06-19'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qfr5-wjpw-q4c4'
references:
  - url: >-
      https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcm
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-46823'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/221507'
  - url: 'https://github.com/python-ldap/python-ldap'
tags:
  - osv
  - pip
epss: 0.01897
epssPercentile: 0.78773
ingestedAt: '2026-07-08T18:25:52.408Z'
---

## Overview

python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.

## Affected packages

- `python-ldap < 3.4.0`

## Remediation

Upgrade to a patched release:

- `python-ldap 3.4.0`