BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-19

Assigner: PostgreSQL

Description

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-13

Last Modified

2025-11-19

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12764

EUVD

EUVD-2025-169294

Affected Vendors & Products

Vendor	Product	Version / Range
pgadmin	pgadmin_4	to 9.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an LDAP injection in pgAdmin versions up to 9.9. It occurs in the LDAP authentication process, where an attacker can inject special LDAP characters into the username. This causes both the LDAP server and the client to process an unusually large amount of data, leading to a denial of service (DoS) condition.

Impact Analysis

The vulnerability can cause a denial of service (DoS) by making the LDAP server and client process an excessive amount of data. This can disrupt authentication services and potentially make the pgAdmin application unavailable to users.

Hi! I’m here to help you understand CVE-2025-12764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70