CVE-2020-25710
A flaw was found in OpenLDAP in versions before 2.4.56.
Published May 28, 2021 · updated Oct 14, 2026 · openldap openldap
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 28, 2021 · NIST NVD
Detected
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
Affected
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora33
- cpe openldap/openldapversion unspecified
- cpe redhat/enterprise linux5.0
- cpe redhat/enterprise linux6.0
- cpe redhat/enterprise linux7.0
- cpe redhat/jboss core servicesversion unspecified
- cpe redhat/jboss enterprise application platform5.0.0
- cpe redhat/jboss enterprise web server2.0.0
Sources
- CVE.orgVulnerability recordCVE-2020-25710
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-25710
30-day exploitation probability 2.7%
first.org - NIST NVDVulnerability recordCVE-2020-25710
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
nvd.nist.gov