Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the opendj-dsml-servlet process. An attacker can access internal services, read local files, or exhaust server memory by submitting specially crafted DSML add/modify requests containing malicious URIs...

PT-2026-67586

The DSMLv2 SOAP gateway opendj-dsml-servlet in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker...