CVE-2025-27497

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Mar 5, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-274985.7aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertexCVE-2025-274996.1WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerabCVE-2025-27508.8A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSCVE-2025-275006.1OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel caCVE-2025-275018.6OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessedCVE-2025-275055.3GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API securiCVE-2025-275066.1NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to ReflecteCVE-2025-275079.0The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API coCVE-2025-275087.5Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it CVE-2025-275099.3fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-foCVE-2025-27518.8A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the functCVE-2025-275109.3conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mi