Security readout for executives and security teams
Plain-English summary
CVE-2021-46823 can let an authenticated remote user make some applications unavailable if they use vulnerable python-ldap schema parsing on untrusted LDAP schema definitions. The issue is a regular expression denial of service flaw, not evidence of data theft or code execution in the provided sources.
Executive priority
Treat this as a targeted availability risk. Prioritize systems where LDAP schema parsing touches production authentication, identity, or customer-facing services. The urgency is lower than active exploitation or code execution, but outages in identity-adjacent systems can have broad business impact.
Technical view
python-ldap before 3.4.0 has a ReDoS flaw in the ldap.schema parser when handling untrusted schema definitions. A crafted input can consume excessive processing and cause denial of service. The source bundle does not provide CVSS, CWE, affected CPEs, or confirmed active exploitation.
Likely exposure
Exposure is most likely in applications using python-ldap before 3.4.0 and parsing LDAP schema definitions from authenticated remote users, remote directories, or other untrusted sources. Systems only using python-ldap without ldap.schema or without untrusted schema input appear less exposed based on the provided evidence.
Exploitation context
The CVE description says a remote authenticated attacker could trigger denial of service with crafted regex input. KEV is false, and the provided sources do not state active exploitation, public exploitation, or unauthenticated exploitation.
Researcher notes
Key uncertainty remains because the source bundle lacks CVSS, CWE, CPEs, and detailed patch notes. Validate actual risk by confirming vulnerable package versions and whether untrusted schema definitions reach ldap.schema. Do not assume all python-ldap deployments are affected equally.
Mitigation direction
- Upgrade python-ldap to 3.4.0 or later where used.
- Stop parsing untrusted LDAP schema definitions until upgraded.
- Restrict who can submit or influence LDAP schema inputs.
- Check vendor and package-manager guidance for downstream fixed builds.
Validation and detection
- Inventory applications and containers for python-ldap versions before 3.4.0.
- Identify whether code imports or uses ldap.schema parsing paths.
- Review schema input sources for user-controlled or remote authenticated data.
- Confirm patched versions are deployed in production and build artifacts.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-46823 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcmCVE reference · x_refsource_MISC
- https://exchange.xforce.ibmcloud.com/vulnerabilities/221507CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.