{"id":"GHSA-68r5-9hpg-7qw9","aliases":[],"status":"published","title":"OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway","description":"The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-73","CWE-918"],"published":"2026-07-24T21:46:06Z","modified":"2026-07-24T22:00:26Z","fixes":[{"ecosystem":"Maven","package":"org.openidentityplatform.opendj:opendj-dsml-servlet","fixed_in":["5.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.openidentityplatform.opendj:opendj-dsml-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.1.1"},{"fixed":"5.1.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.openidentityplatform.opendj:opendj-dsml-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2"}]}],"versions":["4.10.0","4.10.1","4.10.2","4.4.10","4.4.11","4.4.12","4.4.13","4.4.14","4.4.15","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.7.0","4.8.0","4.8.1","4.8.2","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4","5.0.1","5.0.2","5.0.3","5.0.4","5.1.0","5.1.1"]}],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9","tags":["web"]},{"url":"https://github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3","tags":["web"]},{"url":"https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-68r5-9hpg-7qw9"},{"url":"https://github.com/OpenIdentityPlatform/OpenDJ","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-68r5-9hpg-7qw9","title":"OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway","description":"The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.","status":"published","published":"2026-07-24T21:46:06Z","modified":"2026-07-24T21:46:08Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"critical"}],"cwes":["CWE-73","CWE-400","CWE-918"],"updated_at":"2026-11-02T14:40:53.707378Z"}],"osv":[{"id":"GHSA-68r5-9hpg-7qw9","title":"OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway","description":"The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.","status":"published","published":"2026-07-24T21:46:06Z","modified":"2026-07-24T22:00:26.95559133Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"critical"}],"cwes":["CWE-400","CWE-73","CWE-918"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}