CVE-2025-27497: OpenDJ LDAP Directory Service DoS Flaw

CVE-2025-27497 Overview

CVE-2025-27497 is a denial-of-service (DoS) vulnerability in OpenDJ, an LDAPv3 compliant directory service maintained by the Open Identity Platform. Versions prior to 4.9.3 enter an unresponsive state when processing an ldapsearch request against an alias entry that participates in an alias loop, provided the request uses alias dereferencing set to always. The server stops responding to all subsequent LDAP requests without crashing or generating restart events. Operators must manually restart the process to recover service. The flaw is tracked under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact

An unauthenticated network attacker can render an OpenDJ directory service unresponsive to all LDAP requests by issuing a single search query against a looped alias entry.

Affected Products

• OpenIdentityPlatform OpenDJ versions prior to 4.9.3
• Any LDAP-dependent application relying on a vulnerable OpenDJ backend
• Identity and access management stacks using OpenDJ as an authentication directory

Discovery Timeline

• 2025-03-05 - CVE-2025-27497 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-27497

Vulnerability Analysis

The vulnerability resides in the local backend search operation handler of OpenDJ. When an LDAP client submits a search request with the derefAliases flag set to always, the server resolves alias entries to their target distinguished names (DNs) before evaluating the search base. If two or more alias entries reference each other in a cycle, the dereferencing routine follows the chain indefinitely. The search thread never exits the resolution loop, which blocks the worker and prevents the server from processing additional LDAP requests.

The condition does not corrupt directory data. The Berkeley DB JE backend remains consistent, and a controlled restart returns the service to a healthy state. However, the affected process must be terminated externally because the LDAP listener no longer responds to administrative requests.

Root Cause

The root cause is a missing cycle-detection check in LocalBackendSearchOperation.java. The pre-patch code dereferenced alias entries iteratively without tracking which DNs had already been visited. The fix introduces a HashSet<DN> to record visited alias DNs and aborts dereferencing when a repeat entry is encountered, eliminating the infinite loop.

Attack Vector

Exploitation requires network reachability to the LDAP listener and the ability to issue a search request. No authentication is required when anonymous binds or self-service search are permitted on the targeted naming context. An attacker who can create or influence directory entries can plant the alias loop, after which any consumer of the directory that performs alias dereferencing can trigger the condition. A single crafted search request is sufficient to disable the service.

// Patch excerpt: LocalBackendSearchOperation.java
// Adds visited-DN tracking to break alias dereference loops.
 * Copyright 2008-2010 Sun Microsystems, Inc.
 * Portions Copyright 2011-2016 ForgeRock AS.
- * Portions Copyright 2024 3A Systems, LLC.
+ * Portions Copyright 2024-2025 3A Systems, LLC.
 */
package org.opends.server.workflowelement.localbackend;

+import java.util.HashSet;
+import java.util.Set;
import java.util.concurrent.atomic.AtomicBoolean;

import org.forgerock.i18n.slf4j.LocalizedLogger;

Source: OpenDJ commit 08aee47

Detection Methods for CVE-2025-27497

Indicators of Compromise

• LDAP search requests containing derefAliases=always targeting alias entries on a vulnerable OpenDJ instance
• Directory entries of objectClass: alias whose aliasedObjectName attribute forms a cycle with another alias entry
• OpenDJ worker threads stuck in LocalBackendSearchOperation frames with no progression in access logs

Detection Strategies

• Audit the directory for alias entries and verify that no aliasedObjectName chain forms a cycle
• Alert on sudden cessation of OpenDJ access log entries while the JVM process remains alive
• Inspect search request traffic for repeated derefAliases=3 (always) values originating from unexpected clients

Monitoring Recommendations

• Track LDAP response latency and request throughput per backend; flag prolonged zero-throughput windows
• Monitor OpenDJ JVM thread states for workers blocked inside alias resolution call paths
• Forward OpenDJ access and error logs to a centralized analytics platform and correlate with service-availability probes

How to Mitigate CVE-2025-27497

Immediate Actions Required

• Upgrade all OpenDJ instances to version 4.9.3 or later, which contains the official fix
• Restrict network exposure of the LDAP listener to trusted clients using firewall or service mesh policies
• Review existing alias entries and remove or correct any aliasedObjectName references that form loops

Patch Information

The vulnerability is fixed in OpenDJ 4.9.3. The corrective change is committed in OpenDJ commit 08aee47 and documented in GitHub Security Advisory GHSA-93qr-h8pr-4593. The patch adds a HashSet-based visited-DN tracker inside the local backend search operation to terminate alias dereferencing when a cycle is detected.

Workarounds

• Disable anonymous search access and require authentication on naming contexts that contain alias entries
• Configure client applications to use derefAliases=never or derefAliases=finding instead of always where feasible
• Apply access control instructions (ACIs) that block write access to aliasedObjectName for non-administrative accounts to prevent attacker-introduced loops

# Verify installed OpenDJ version and upgrade path
./bin/status --offline | grep -i version

# After upgrading, validate alias entries for cycles
ldapsearch -H ldap://opendj.example.com -D "cn=Directory Manager" -W \
  -b "dc=example,dc=com" "(objectClass=alias)" dn aliasedObjectName