Share on:

OpenDJ 5.1.2 Released

What’s new

Addressed OpenDJ security vulnerabilities:
- CVE-2026-62366 - Unauthenticated stack exhaustion when decoding an LDAP search filter (DoS)
- CVE-2026-62373 - JMX MBean-argument deserialization without a serial filter
- CVE-2026-62375 - Unbounded VLV offset array allocation leading to memory-exhaustion DoS
- GHSA-68r5-9hpg-7qw9 - Unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
- GHSA-p279-2cqp-84jg - SASL PLAIN authzid bypassing the proxy ACI scope check
Addressed third-party dependency vulnerabilities:
- CVE-2026-9828 - QOS.CH logback-core deserialization of untrusted data
- CVE-2026-10532 - Logback object injection through HardenedObjectInputStream modules

Fixed StackOverflowError while parsing long ACI with repetitive targets
Fixed StringIndexOutOfBoundsException on a blank bind rule in ACI
Fixed NullPointerException decoding an ACI bind rule with a missing and/or operand
Fixed ACI grouped bind rule wrongly rejected when a value contains parentheses

Fixed OutOfMemoryError during replication initialize with the JDBC backend
Rejected TCP self-connects in replication connect paths
Fixed import/export context leak on failed initializeRemote validation
Fixed replication catch-up re-sending updates with the original assured flag
Prevented rolling back a concurrently adopted generation ID on an aborted handshake

Fixed cn=changelog search failing when aliases are dereferenced
Fixed dereferencing an alias that points into another backend
Fixed alias dereferencing dropping entries and accumulating DNs
Fixed global idle-time-limit having no effect on client connections
Fixed race in TraditionalWorkQueue.isIdle()
Fixed finalizeWorkQueue never cancelling queued operations
Restored partial import semantics for include/exclude branches
Fixed ArrayIndexOutOfBoundsException on truncated percent-encoding in LDAP URLs
Rejected malformed bracketed IPv6 hosts in HostPort
Fixed embedded server rebuildIndex failing with Connect Error
Fixed embedded server setup failing with “Time service not started”
Log JMX RMI connector startup failure at error level

Fixed Windows scripts for install paths with spaces and parentheses
Fixed duplicate SNMP connection handler entries in the packaged config.ldif
Fixed duplicate opendj-server-legacy classes in the distribution lib/
Declared the deb/rpm runtime dependencies (java, which, chkconfig)
Modernized the OpenDJ Docker images and broadened their multi-architecture build matrix
Documented Windows MSI install, upgrade and uninstall
Added missing tools references to the documentation
Bumped org.openidentityplatform.commons to 3.1.2

Revived, fixed and enabled a large number of previously disabled test suites (ACI, SNMP, quicksetup, replication stress and slow-group tests)
Added an OpenDJ vs OpenLDAP LDAP benchmark GitHub Action and PDB vs JE benchmarks
Added CI smoke tests for the addrate/authrate/modrate/searchrate tools and the Windows MSI install
Added CodeQL code scanning and enabled Javadoc doclint

Full changeset (more details)