OpenDJ vulnerabilities

3 known vulnerabilities in OpenDJ from OpenIdentityPlatform. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  OpenDJ: Deserialization of Untrusted Data

  CVE-2026-46495Sep 15, 2026OpenIdentityPlatformEPSS 1.13%

  OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a rest

• 9.6 Critical severity

  OpenDJ: Improper Authorization

  CVE-2026-73644Aug 13, 2026OpenIdentityPlatform

  OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluat

• 8.7 High severity

  OpenDJ: Loop with Unreachable Exit Condition

  CVE-2025-27497Mar 5, 2025OpenIdentityPlatform

  OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exis