---
id: GHSA-68r5-9hpg-7qw9
title: >-
  OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the
  DSMLv2 gateway
summary: >-
  OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the
  DSMLv2 gateway
severity: critical
cvss: 9.4
cwe:
  - CWE-73
  - CWE-400
  - CWE-918
vendor: openidentityplatform
product: 'org.openidentityplatform.opendj:opendj-dsml-servlet'
ecosystem: maven
affected:
  - 'org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1'
patched:
  - 'org.openidentityplatform.opendj:opendj-dsml-servlet 5.1.2'
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-68r5-9hpg-7qw9'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3
  - url: 'https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2'
  - url: 'https://github.com/advisories/GHSA-68r5-9hpg-7qw9'
tags:
  - ghsa
  - maven
ingestedAt: '2026-07-24T22:40:27.154Z'
---

## Overview

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.

## Affected packages

- `org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1`

## Remediation

Upgrade to a patched release:

- `org.openidentityplatform.opendj:opendj-dsml-servlet 5.1.2`