ZeroDay Findings
Sign inSign up

Findings

CVE-2022-29155

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.

Published May 4, 2022 · updated Oct 14, 2026 · openldap openldap

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 4, 2022 · NIST NVD

    Detected

    In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

  2. Oct 14, 2026 · NIST NVD

    Updated

    In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux9.0
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410c firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700e firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe openldap/openldapversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2022-29155

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-29155

    30-day exploitation probability 64.5%

    first.org
  • NIST NVDVulnerability recordCVE-2022-29155

    In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of

    nvd.nist.gov

References