How severe is GHSA-68r5-9hpg-7qw9?

GHSA-68r5-9hpg-7qw9 has a CVSS score of 9.4/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-68r5-9hpg-7qw9?

GHSA-68r5-9hpg-7qw9 affects the following packages: org.openidentityplatform.opendj:opendj-dsml-servlet (Maven). Ecosystems affected: Maven.

How do I fix GHSA-68r5-9hpg-7qw9?

Update org.openidentityplatform.opendj:opendj-dsml-servlet to 5.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-68r5-9hpg-7qw9 is resolved across your whole dependency graph.

How do I detect GHSA-68r5-9hpg-7qw9 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.openidentityplatform.opendj:opendj-dsml-servlet, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-68r5-9hpg-7qw9 if there is no patch (or I can't update yet)?

Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Is GHSA-68r5-9hpg-7qw9 actively exploited in the wild?

No public exploit code has been indexed for GHSA-68r5-9hpg-7qw9 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-68r5-9hpg-7qw9 published, and has it been updated?

GHSA-68r5-9hpg-7qw9 was published on July 24, 2026 and was last updated on July 24, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

OpenDJ unauthenticated SSRF, local file read and…

Real-World Exposure

1 pkg affected

☕org.openidentityplatform.opendj:opendj-dsml-servlet

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.openidentityplatform.opendj:opendj-dsml-servlet`	all versions	5.1.2`org.openidentityplatform.opendj:opendj-dsml-servlet:5.1.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.openidentityplatform.opendj:opendj-dsml-servlet, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.openidentityplatform.opendj:opendj-dsml-servlet to 5.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-68r5-9hpg-7qw9 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferen

O3 Security · Impact-Aware SCA

Is GHSA-68r5-9hpg-7qw9 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gatewayGHSA-68r5-9hpg-7qw9