{"id":"GHSA-68r5-9hpg-7qw9","title":"OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway","summary":"OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway","severity":"critical","cvss":9.4,"cwe":["CWE-73","CWE-400","CWE-918"],"vendor":"openidentityplatform","product":"org.openidentityplatform.opendj:opendj-dsml-servlet","ecosystem":"maven","affected":["org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1"],"patched":["org.openidentityplatform.opendj:opendj-dsml-servlet 5.1.2"],"published":"2026-07-24","updated":"2026-07-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-68r5-9hpg-7qw9","references":[{"url":"https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9"},{"url":"https://github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3"},{"url":"https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2"},{"url":"https://github.com/advisories/GHSA-68r5-9hpg-7qw9"}],"tags":["ghsa","maven"],"ingestedAt":"2026-07-24T22:40:27.154Z","slug":"GHSA-68r5-9hpg-7qw9","body":"## Overview\n\nThe DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.\n\n## Affected packages\n\n- `org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.openidentityplatform.opendj:opendj-dsml-servlet 5.1.2`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}