5.1.2

What's Changed

• Add an OpenDJ vs OpenLDAP LDAP benchmark GitHub Action by @vharseko in #654
• CVE-2026-62366 OpenDJ Unauthenticated stack exhaustion when decoding an LDAP search filter (DoS) thanks @Pig-Tail ❤️
• CVE-2026-62373 OpenDJ JMX MBean-argument deserialization without a serial filter thanks @Pig-Tail @tonghuaroot @wodzen ❤️
• CVE-2026-62375 OpenDJ Unbounded VLV offset array allocation leading to memory-exhaustion DoS thanks @Pig-Tail ❤️
• GHSA-68r5-9hpg-7qw9 OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway thanks @manus-use ❤️
• GHSA-p279-2cqp-84jg SASL PLAIN authzid bypassing the proxy ACI scope check thanks @hypnguyen1209 ❤️
• CI: full Java matrix on ubuntu only; macOS/Windows build with Java 11 and 26 by @vharseko in #704
• Modernizes the OpenDJ Docker images and broadens their multi-architecture build matrix. by @vharseko in #655
• Benchmark the built Docker image against the released one by @vharseko in #656
• Stabilize Oracle JDBC backend test on CI by @vharseko in #662
• Log JMX RMI connector startup failure at error level by @vharseko in #699
• Docs: add missing tools references by @maximthomas in #657
• CI: dump OpenDJ container logs when Docker image smoke tests fail by @vharseko in #713
• Refactor file deletion logic to combine null check and length check. by @vharseko in #653
• Add CI smoke tests for the addrate/authrate/modrate/searchrate tools by @vharseko in #658
• Fix duplicate SNMP connection handler entries in packaged config.ldif by @vharseko in #659
• Fix duplicate opendj-server-legacy classes in distribution lib/ by @vharseko in #661
• Add CI install-test for the Windows MSI + document MSI install/upgrade/uninstall by @vharseko in #664
• [#665] Fix StackOverflowError while parsing long ACI with repetitive targets by @vharseko in #666 thanks @myandrews ❤️
• [#693] Fix Windows scripts for install paths with spaces and parentheses by @vharseko in #671
• Fix two broken AciTests cases and enable the suite in the default build by @vharseko in #675
• [#673] Fix ArrayIndexOutOfBoundsException on truncated percent-encoding in LDAP URLs by @vharseko in #676 thanks @myandrews ❤️
• Declare the deb/rpm runtime dependencies (java, which, chkconfig) by @vharseko in #677
• [#697] Fix global idle-time-limit having no effect on client connections by @vharseko in #684
• Fix embedded server rebuildIndex failing with Connect Error by @vharseko in #685
• Fix and enable broken tests from the slow group by @vharseko in #686
• [#696] Fix embedded server setup failing with "Time service not started" by @vharseko in #687
• Revive the quicksetup test suite by @vharseko in #694
• Fix and enable the replication StressTest by @vharseko in #698
• Remove the unfixable testStateMachineFull and fix the dead replay pool by @vharseko in #700
• Fix ACI grouped bind rule wrongly rejected when a value contains parentheses by @vharseko in #716
• Enable the remaining slow-group tests in the default build by @vharseko in #702
• Include *TestSuite classes in the failsafe run by @vharseko in #703
• Enable the SNMP tests in the default build by @vharseko in #705
• Fix and enable the AlternateRootDN ACI test by @vharseko in #706
• [#709] Enable disabled and invisible tests across the sibling modules by @vharseko in #707
• [#712] Fix StringIndexOutOfBoundsException on blank bind rule in ACI by @vharseko in #715 thanks @myandrews ❤️
• CVE-2026-9828 QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability by @dependabot[bot] in #717
• ci: add "Benchmark PDB vs JE" step to build-docker by @vharseko in #718
• Add concurrency groups to GitHub Actions workflows by @vharseko in #721
• [#695] Fix race in TraditionalWorkQueue.isIdle() by @vharseko in #688
• [#690] Fix finalizeWorkQueue never cancelling queued operations by @vharseko in #691
• [#692] Restore partial import semantics for include/exclude branches by @vharseko in #689
• Restrict Unix integration-test steps to Linux only by @vharseko in #723
• ci: add CodeQL code scanning workflow by @vharseko in #722
• [#719] Fix NullPointerException decoding an ACI bind rule with a missing and/or operand by @vharseko in #720 @myandrews ❤️
• CVE-2026-10532 Logback vulnerable to Object Injection through HardenedObjectInputStream modules by @dependabot[bot] in #724
• [#728] Reject TCP self-connects in replication connect paths by @vharseko in #729
• Fix flaky BindOperationTestCase subtree auth-info tests by @vharseko in #727
• [#730] Fix import/export context leak on failed initializeRemote validation by @vharseko in #731
• Fix intermittent GenerationIdTest.testMultiRS by re-advertising genId on change by @vharseko in #725
• [#710] Fix replication catch-up re-sending updates with the original assured flag by @vharseko in #714
• [#726] Reject malformed bracketed IPv6 hosts in HostPort by @vharseko in #732 thanks @myandrews ❤️
• Enable Javadoc doclint (all,-missing) and fail on warnings by @vharseko in #734
• [#735] Do not roll back a concurrently adopted generation ID on aborted handshake by @vharseko in #736
• [#737] Fix cn=changelog search failing when aliases are dereferenced by @vharseko in #740
• [#738] Fix dereferencing an alias that points into another backend by @vharseko in #741
• Harden opendj-docker apt step: force IPv4 + retries by @vharseko in #743
• [#739] Fix alias dereferencing dropping entries and accumulating DNs by @vharseko in #742
• [#744] Fix flaky ChangelogBackendTestCase: keep generated CSN batches monotonic by @vharseko in #745
• Bump org.openidentityplatform.commons to 3.1.2 by @vharseko in #733
• [#708] Fix OutOfMemory during replication initialize with JDBC backend by @vharseko in #711 thanks @ldap4life ❤️

Full Changelog: 5.1.1...5.1.2

Backers

Thank you to all our backers! Become a backer 🙏

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. Become a sponsor ❤️