From a61f2f9219bc121eea41a870e181e93a79623743 Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 10 Aug 2026 00:31:24 +0000 Subject: [PATCH] ldap: reject control characters in URL-decoded filter values Closes #22524 --- lib/ldap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ldap.c b/lib/ldap.c index d7e871863d..350bd17377 100644 --- a/lib/ldap.c +++ b/lib/ldap.c @@ -840,7 +840,7 @@ static curl_ldap_num_t ldap_url_parse2_low(struct Curl_easy *data, LDAP_TRACE(("filter '%s'\n", filter)); /* Unescape the filter */ - result = Curl_urldecode(filter, 0, &unescaped, NULL, REJECT_ZERO); + result = Curl_urldecode(filter, 0, &unescaped, NULL, REJECT_CTRL); if(result) { rc = LDAP_NO_MEMORY; -- 2.47.3