https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T07:52:39.118320+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-220541 EUVD-2026-220541 2026-10-08T07:52:39.120418+00:00 EUVD-2026-220541 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27497 fkie_cve-2025-27497 2026-10-08T07:52:39.120448+00:00

OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.

 https://cve.radiocsirt.org/vuln/ghsa-93qr-h8pr-4593 GHSA-93qr-h8pr-4593 — OpenDJ Denial of Service (DoS) using alias loop 2026-10-08T07:52:39.120482+00:00

Affected: Maven: org.openidentityplatform.opendj:opendj-server-legacy

### Summary A denial-of-service (DoS) vulnerability in OpenDJ has been discovered that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an `ldapsearch` request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. I have confirmed this issue using the latest OpenDJ version (9.2), both with the official OpenDJ Docker image and a local OpenDJ server running on my Windows 10 machine.

### Details An unauthenticated attacker can exploit this vulnerability using a single crafted `ldapsearch` request. Fortunately, the server can be restarted without data corruption. While this attack requires the existence of an alias loop, I am uncertain whether such loops can be easily created in specific environments or if the method can be adapted to execute other DoS attacks more easily.

### PoC (Steps to Reproduce) 1. Set up an OpenDJ server instance as usual, using the base DN `dc=example,dc=com` 2. Import the attached `example_data_alias_dos.ldif` file into the LDAP database 3. Ensure that the `ldap3` Python library is installed (`pip install ldap3`) 4. Run the attached Python script `python opendj_alias_dos.py`, which searches for alias loops and executes the DoS attack 5. After executing the script, the server will stop responding to requests until it is restarted

### Impact This vulnerability directly…