OpenLDAP vulnerabilities and fixes

CVEs that mention OpenLDAP, ranked by priority. 22 tracked.

OpenLDAP has 22 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 20. Most recent: 2026-01-07. Highest priority: CVE-2022-29155 (score 74/100).

• CVE-2022-29155 CRITICAL 9.8 UPGRADE MITIGATE In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental
• CVE-2021-27212 HIGH 7.5 UPGRADE MITIGATE In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuer
• CVE-2020-36221 HIGH 7.5 UPGRADE MITIGATE An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exac
• CVE-2020-36222 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo va
• CVE-2020-36227 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Can
• CVE-2020-36228 HIGH 7.5 UPGRADE MITIGATE An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List
• CVE-2020-36230 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsi
• CVE-2022-22576 HIGH 8.1 UPGRADE MITIGATE An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse
• CVE-2020-36223 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control h
• CVE-2020-36224 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the sasl
• CVE-2020-36225 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo pr
• CVE-2020-36226 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in t
• CVE-2020-36229 HIGH 7.5 UPGRADE MITIGATE A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN par
• CVE-2020-25692 HIGH 7.5 UPGRADE MITIGATE A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for
• CVE-2020-25709 HIGH 7.5 UPGRADE MITIGATE A flaw was found in OpenLDAP
• CVE-2020-25710 HIGH 7.5 UPGRADE MITIGATE A flaw was found in OpenLDAP in versions before 2.4.56
• CVE-2023-2953 HIGH 7.5 DOWNGRADE MITIGATE A vulnerability was found in openldap
• CVE-2024-10127 CRITICAL 9.8 UPGRADE Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage
• CVE-2019-20902 HIGH 7.5 UPGRADE Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP
• CVE-2023-23749 HIGH 7.5 DOWNGRADE The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to L
• CVE-2020-15719 MEDIUM 4.2 UPGRADE MITIGATE libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party packag
• CVE-2026-22185 MEDIUM 4.6 OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, conta

FAQ

How do I fix OpenLDAP vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is OpenLDAP being exploited right now?

None of the tracked OpenLDAP CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which OpenLDAP CVE should I patch first?

CVE-2022-29155 currently ranks highest (74/100): In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental.

RSS feed for OpenLDAP · ← Back to latest CVEs