High severity · published Mar 5, 2025
CVE-2025-27497
OpenDJ Denial of Service (Dos) using alias loop
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDJ · OpenIdentityPlatform
< 4.9.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27497
github.com
https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf
github.com
https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593
More from OpenDJ
9.6
CVE-2026-73644
OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant
9.2
CVE-2026-46495
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI