CVE-2025-27497highCWE-835

CVE-2025-27497: high-severity vulnerability in OpenIdentityPlatform OpenDJ

OpenDJ Denial of Service (Dos) using alias loop

Published

Follow this CVE+ Monitor OpenDJ+ Monitor org.openidentityplatform.opendj:opendj-server-legacy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
OpenIdentityPlatform · OpenDJ
Related CVEs — OpenIdentityPlatform OpenDJ

In the same product, most dangerous first.

CVE-2026-46495CRITICALOpenDJ Pre-Auth RCE via Java Deserialization in JMX RMIEPSS 1.1%CVE-2026-73644CRITICALOpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grantEPSS 0.4%