Dear Maintainer,

While testing curl, we ran it against an LDAP server sending back crafted
contents. When doing this, we got OpenLDAP to abort due to an assert.

The fact that openldap aborts on an assert implies that the Debian build is a
debug one and not a release build, which seems wrong. A library should not
abort in production and the OpenLDAP library does not do that in release
builds.

The error is thus that Debian ships a debug build of OpenLDAP that gets used
in production by curl (and others).

This problem was originally reported against curl and there is a recipe and
lots of additional details here: https://hackerone.com/reports/3258022

The assert is probably an error too (but beside the point for this issue) and
I have reported it upstream to OpenLDAP here:
https://bugs.openldap.org/show_bug.cgi?id=10370

Thanks,

  / Daniel

Hello Daniel,

NDEBUG was discussed a few years ago in
<https://bugs.openldap.org/show_bug.cgi?id=8240>.

The package is built with --enable-debug intentionally, so that users
can enable debug logging if they need it. Some valuable diagnostics, for
example TLS diagnostics, are only available via debug logging.

I thought it was generally preferred from a security perspective to keep
assert() enabled in production, so that programs fail fast rather than
get into invalid states that might potentially be exploitable. I'm not
sure whether Debian has any official guidance on this, but see for
example <https://lists.debian.org/debian-devel/2013/02/msg00124.html>.

thanks,
Ryan

Hi Daniel!

Thanks for your report. I take an interest in OpenLDAP's Debian package and did some research, mainly for the sake of the more regular maintainers and helpers.
Yes, this does look weird. The Debian package specifies arguments to the configure script at https://salsa.debian.org/openldap-team/openldap/-/blob/master/debian/configure.options#L67 and there we do pass --enable-debug explicitly. This is just a coincidence and it's not actually the culprit though, because --enable-debug is OpenLDAP upstream's default, even in their release tarballs. At https://salsa.debian.org/openldap-team/openldap/-/blob/master/configure.ac#L230 the option is defined and at line 2507 the parameter is used. It appears the only scenario where the assertions aren't built in is when --disable-debug or --enable-debug=no are explicitly passed.

To confirm I removed --enable-debug from Debian's invocation of configure and noticed in the build tree that the generated include/portable.h header still defines LDAP_DEBUG as 1.

It appears that Debian uses the official release tarballs at https://openldap.org/software/download/OpenLDAP/openldap-release/ in making its packages (after discarding some contents and repacking it due mainly to licensing issues around documentation), and Debian's pristine-tar branch hints this was adhered to.
With all due respect, I wonder if you drew this conclusion hastily and I'm not sure it's accurate. Upstream's build/version.sh prints
OL_TYPE=Release
OL_STRING="OpenLDAP 2.6.10-Release"
although this only examines the source tree and doesn't depend on build configuration. It's not obvious that there is an option besides an explicit --disable-debug that would accomplish just that.

In conclusion, it looks like upstream's default to build assertions in and it's not obvious if downstream distributors are supposed to pass --disable-debug explicitly. Maybe advice is somewhere in their documentation, but otherwise I don't see any equivalent to, say, GCC's --enable-checking=release for example. Checking in with upstream to ensure this default is an intentional one would be a next step. In the meantime this doesn't look like an egregious misconfiguration and I expect other downstreams leave this default alone.
That was fixed quickly! Thanks for reporting to them as well.
P.S. Is this your new Framework by chance? I hope your install went well 🙂

Hi Daniel!

Thanks for your report. I take an interest in OpenLDAP's Debian package and did some research, mainly for the sake of the more regular maintainers and helpers.
Yes, this does look weird. The Debian package specifies arguments to the configure script at https://salsa.debian.org/openldap-team/openldap/-/blob/master/debian/configure.options#L67 and there we do pass --enable-debug explicitly. This is just a coincidence and it's not actually the culprit though, because --enable-debug is OpenLDAP upstream's default, even in their release tarballs. At https://salsa.debian.org/openldap-team/openldap/-/blob/master/configure.ac#L230 the option is defined and at line 2507 the parameter is used. It appears the only scenario where the assertions aren't built in is when --disable-debug or --enable-debug=no are explicitly passed.

To confirm I removed --enable-debug from Debian's invocation of configure and noticed in the build tree that the generated include/portable.h header still defines LDAP_DEBUG as 1.

It appears that Debian uses the official release tarballs at https://openldap.org/software/download/OpenLDAP/openldap-release/ in making its packages (after discarding some contents and repacking it due mainly to licensing issues around documentation), and Debian's pristine-tar branch hints this was adhered to.
With all due respect, I wonder if you drew this conclusion hastily and I'm not sure it's accurate. Upstream's build/version.sh prints
OL_TYPE=Release
OL_STRING="OpenLDAP 2.6.10-Release"
although this only examines the source tree and doesn't depend on build configuration. It's not obvious that there is an option besides an explicit --disable-debug that would accomplish just that.

In conclusion, it looks like upstream's default to build assertions in and it's not obvious if downstream distributors are supposed to pass --disable-debug explicitly. Maybe advice is somewhere in their documentation, but otherwise I don't see any equivalent to, say, GCC's --enable-checking=release for example. Checking in with upstream to ensure this default is an intentional one would be a next step. In the meantime this doesn't look like an egregious misconfiguration and I expect other downstreams leave this default alone.
That was fixed quickly! Thanks for reporting to them as well.
P.S. Is this your new Framework by chance? I hope your install went well 🙂

Given this information, it certainly seems like I made some wrong assumptions.
If indeed OpenLDAP themselves do this (and ships with asserts aborting by
default), then I think the problem (because I think it is a problem) is theirs
to fix and not Debian's as I had presumed.

Thanks,

Given this information, it certainly seems like I made some wrong assumptions.
If indeed OpenLDAP themselves do this (and ships with asserts aborting by
default), then I think the problem (because I think it is a problem) is theirs
to fix and not Debian's as I had presumed.

Thanks,

Given this information, it certainly seems like I made some wrong assumptions.
If indeed OpenLDAP themselves do this (and ships with asserts aborting by
default), then I think the problem (because I think it is a problem) is theirs
to fix and not Debian's as I had presumed.

Thanks,

We believe that the bug you reported is fixed in the latest version of
openldap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1109791@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ryan Tandy <ryan@nardis.ca> (supplier of updated openldap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 22 Jun 2026 15:45:06 -0700
Source: openldap
Architecture: source
Version: 2.6.13+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Changed-By: Ryan Tandy <ryan@nardis.ca>
Closes: 1103918 1104574 1107415 1109791 1124973 1130869 1131044 1138420
Changes:
 openldap (2.6.13+dfsg-1) unstable; urgency=medium
 .
   [ Ryan Tandy ]
   * New upstream release.
     - fixed libldap assertion failure on certain invalid server responses
       (ITS#10370) (Closes: #1109791)
   * Temporarily disable slapd-smbk5pwd autopkgtest, broken by heimdal-kdc
     lacking a systemd unit file; see #1039220.
   * Set libldap2-dev to Architecture: any and Multi-Arch: same, matching the
     real libldap-dev package that it depends on. Thanks to Helmut Grohne.
     (Closes: #1103918)
   * d/watch: Use the openldap-release index instead of just the current
     release page. Fixes "uscan --download-current-version" when the current
     version is not the latest.
   * Update Portuguese debconf templates translation.
     Thanks to Américo Monteiro. (Closes: #1107415)
   * Add Chinese debconf templates translations.
     Thanks to Yangfl. (Closes: #1124973)
   * Move the slapd-pw-sha2(5) man page to the slapd package.
     Thanks to Jens Meißner. (Closes: #1130869)
   * Update Italian debconf templates translation.
     Thanks to Luca Monducci.
   * Change default shell for openldap user from /bin/false to systemd-sysusers
     default shell (/usr/sbin/nologin).
   * Create the openldap user unconditionally, even if SLAPD_USER is changed.
     If needed, the user name can be customized, or creation disabled, by
     overriding /usr/lib/sysusers.d/slapd.conf with a drop-in.
   * Add upstream patch to fix test017 failing on 32-bit systems. (ITS#10508)
   * Build and install the slapo-autoca(5) overlay. (Closes: #1131044)
   * Install nestgroup.la, missed when slapo-nestgroup(5) was added.
   * Add upstream patch to fix FTBFS with OpenSSL 4.0.
     (ITS#10498) (Closes: #1138420)
   * d/control:
     - Update Standards-Version to 4.7.4.
     - Drop redundant Priority and Rules-Require-Root fields.
 .
   [ Jonas Jelten ]
   * d/t/ppm-contrib: test ppm password quality module (LP: #2121816)
   * d/slapd.config: fix infinite loop for invalid initial config (LP: #12470)
 .
   [ Luca Boccassi ]
   * Use dh-sequence-installsysusers for system user/group creation
     (Closes: #1104574)
 .
   [ Grayson Wolf ]
   * d/slapd.service: make ExecStart path absolute (LP: #2152633)
Checksums-Sha1:
 9e09e12206effa00f0e2d7a3f51bb13b60ff38de 3281 openldap_2.6.13+dfsg-1.dsc
 ce13081e79929413d80c3cf93fde7cf697dc6de8 3801012 openldap_2.6.13+dfsg.orig.tar.xz
 6ef0b3171c428d870c900d54ef25758b5231e6ec 177256 openldap_2.6.13+dfsg-1.debian.tar.xz
Checksums-Sha256:
 c4fc20d12262cecedfaf5b416cfb5fb747899999a7d8189dd5838ede7a138b4f 3281 openldap_2.6.13+dfsg-1.dsc
 61baeca1b41cd0620a8c40899fbc11657898e99ba4ba0e9328fac8e58c58effa 3801012 openldap_2.6.13+dfsg.orig.tar.xz
 c3f462528e5ae3f1e0918a5eabfb4e3e550baf8ddabf374baa2f5ca09b7a1eb8 177256 openldap_2.6.13+dfsg-1.debian.tar.xz
Files:
 e90d2688cc17ac1814618cbbe660f964 3281 net optional openldap_2.6.13+dfsg-1.dsc
 7d9c4602c20bb59fcdd25bd7528a0a10 3801012 net optional openldap_2.6.13+dfsg.orig.tar.xz
 50e6d56aa4418d426b6bff9ac1e81513 177256 net optional openldap_2.6.13+dfsg-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEPSfh0nqdQTd5kOFlIp/PEvXWa7YFAmo5wOcPHHJ5YW5AbmFy
ZGlzLmNhAAoJECKfzxL11mu2cdkP/RMFmEQDvQzUB7OZ3usdJSO+Za7hnRNhIMq+
2xkfKEETlR13UOoEAwTd1oevK+lQeqrKoSjjLxYGa0gudXl2kPfibIX+XTGFRX60
6OK0rggs2rkaujobHLaoQVE/aGgG46vw4ju0zvo/hXkMQSY2DgAzP/oaSJD5Qkek
K2OVrVw58MkE5f1WSWWKTJkTUrwmqVIUukyOMROKcfEE/ijDIW/nM3ykIH3m2oXz
6DHesCm2BlXPphN+6lmnxaJjjutIsikeDeRlGk7PMbYAT/Zl3Hy7uYR7q9/KKvy6
ZW51aCrFC+fWI69WC+O+KAsZKKEF4IqIhX9aVBFZdAU5VgfPifFFsUTCRkncVavY
80P/dN0b59+x9Oo7RjmrOHa/wgFaZ5hx2yOHygTD13uX/E29Xul+WtORFKV3tF7H
Z4WfHFD+CmG32W1awt5J/75lXCf5aeUDGUW2P0sXQcL4rgw4z9rZQ8wMS4tl6A+v
PcUy5wQ5QqfZ4EV8CmNXMR+quMAVSfs3406kEgvWf9lFn4bbswqH4iH25UIC8w5d
zojno3uDGGr5pnW44kgCYwvmIAl+D66ev3VHVsLsQQo6D4CyFdJD5mVX0T/Oy6pu
NcK3DMAjTjTyiyPefszasiy/XmffptC0Tk5NrVtc4RjBJhrbQJOVRcz0m1nBYJeG
1wFbPF4L
=D4gw
-----END PGP SIGNATURE-----