GHSA-68r5-9hpg-7qw9

Source

https://github.com/advisories/GHSA-68r5-9hpg-7qw9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-68r5-9hpg-7qw9/GHSA-68r5-9hpg-7qw9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-68r5-9hpg-7qw9

Published

2026-07-24T21:46:06Z

Modified

2026-07-24T22:00:26Z

Severity

9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H CVSS Calculator

Summary

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

Details

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.

Database specific

{
    "cwe_ids":  [
        "CWE-400",
        "CWE-73",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-24T21:46:06Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

Maven / org.openidentityplatform.opendj:opendj-dsml-servlet

Package

Name: org.openidentityplatform.opendj:opendj-dsml-servlet; View open source insights on deps.dev
Purl: pkg:maven/org.openidentityplatform.opendj/opendj-dsml-servlet

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.1.2

Affected versions

4.*

4.4.7

4.4.8

4.4.9

4.4.10

4.4.11

4.4.12

4.4.13

4.4.14

4.4.15

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

4.5.5

4.5.6

4.5.7

4.5.8

4.5.9

4.6.1

4.6.2

4.6.3

4.6.4

4.6.5

4.7.0

4.8.0

4.8.1

4.8.2

4.9.0

4.9.1

4.9.2

4.9.3

4.9.4

4.10.0

4.10.1

4.10.2

5.*

5.0.1

5.0.2

5.0.3

5.0.4

5.1.0

5.1.1

Database specific

last_known_affected_version_range

"<= 5.1.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-68r5-9hpg-7qw9/GHSA-68r5-9hpg-7qw9.json"