---
title: "GHSA-68r5-9hpg-7qw9: OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway"
url: https://erroneo.us/security/ghsa/GHSA-68r5-9hpg-7qw9/
description: "GHSA-68r5-9hpg-7qw9 (critical, Maven): OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway. The DSMLv2 SOAP gateway…"
type: advisory
section: "Security Digest"
date_published: 2026-07-24
date_modified: 2026-07-24
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-68r5-9hpg-7qw9"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-68r5-9hpg-7qw9: OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

## Affected packages

- Maven `org.openidentityplatform.opendj:opendj-dsml-servlet` <= 5.1.1 → fixed: 5.1.2

## Details

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.

## Sources

- [GitHub Advisory GHSA-68r5-9hpg-7qw9](https://github.com/advisories/GHSA-68r5-9hpg-7qw9)
- [github.com](https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9)
- [github.com](https://github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3)
- [github.com](https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2)

---
Source page: https://erroneo.us/security/ghsa/GHSA-68r5-9hpg-7qw9/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt