From: anupamme <mediratta@gmail.com>
Date: Mon, 10 Aug 2026 00:31:24 +0000 (+0000)
Subject: ldap: reject control characters in URL-decoded filter values
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Fcurl.git

ldap: reject control characters in URL-decoded filter values

Closes #22524
---

diff --git a/lib/ldap.c b/lib/ldap.c
index d7e871863d..350bd17377 100644
--- a/lib/ldap.c
+++ b/lib/ldap.c
@@ -840,7 +840,7 @@ static curl_ldap_num_t ldap_url_parse2_low(struct Curl_easy *data,
     LDAP_TRACE(("filter '%s'\n", filter));
 
     /* Unescape the filter */
-    result = Curl_urldecode(filter, 0, &unescaped, NULL, REJECT_ZERO);
+    result = Curl_urldecode(filter, 0, &unescaped, NULL, REJECT_CTRL);
     if(result) {
       rc = LDAP_NO_MEMORY;