Add release notes for OpenDJ 5.1.2 and OpenAM 16.1.2 with security updates and new features

Author: maximthomas

_posts/2026-07-17-opendj-5-1-2-released.md

@@ -0,0 +1,89 @@
+---
+layout: home
+landing-title: "OpenDJ 5.1.2 Released"
+landing-title2: "OpenDJ 5.1.2 Released"
+description: OpenDJ 5.1.2 addresses multiple security vulnerabilities including LDAP filter stack exhaustion, JMX deserialization, VLV memory exhaustion and DSMLv2 gateway SSRF, plus ACI, replication and alias dereferencing fixes
+keywords: 'OpenDJ, LDAP, directory server, release 5.1.2, security update, CVE-2026-62366, CVE-2026-62373, CVE-2026-62375, DSMLv2, SASL PLAIN, ACI, replication, alias dereferencing'
+imageurl: 'opendj-og.png'
+share-buttons: true
+---
+# OpenDJ 5.1.2 Released
+[Download](https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2)
+
+## What's new
+
+### Security vulnerabilities
+* Addressed OpenDJ security vulnerabilities:
+    * [CVE-2026-62366](https://github.com/advisories/GHSA-rv4q-c6mr-wxp7) - Unauthenticated stack exhaustion when decoding an LDAP search filter (DoS)
+    * [CVE-2026-62373](https://github.com/advisories/GHSA-qj63-3vrg-vcfx) - JMX MBean-argument deserialization without a serial filter
+    * [CVE-2026-62375](https://github.com/advisories/GHSA-q4wx-wj4j-4657) - Unbounded VLV offset array allocation leading to memory-exhaustion DoS
+    * [GHSA-68r5-9hpg-7qw9](https://github.com/advisories/GHSA-68r5-9hpg-7qw9) - Unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
+    * [GHSA-p279-2cqp-84jg](https://github.com/advisories/GHSA-p279-2cqp-84jg) - SASL PLAIN authzid bypassing the proxy ACI scope check
+* Addressed third-party dependency vulnerabilities:
+    * [CVE-2026-9828](https://nvd.nist.gov/vuln/detail/CVE-2026-9828) - QOS.CH logback-core deserialization of untrusted data
+    * [CVE-2026-10532](https://nvd.nist.gov/vuln/detail/CVE-2026-10532) - Logback object injection through `HardenedObjectInputStream` modules
+
+### Access control (ACI) fixes
+* Fixed `StackOverflowError` while parsing long ACI with repetitive targets
+* Fixed `StringIndexOutOfBoundsException` on a blank bind rule in ACI
+* Fixed `NullPointerException` decoding an ACI bind rule with a missing `and`/`or` operand
+* Fixed ACI grouped bind rule wrongly rejected when a value contains parentheses
+
+### Replication fixes
+* Fixed `OutOfMemoryError` during replication initialize with the JDBC backend
+* Rejected TCP self-connects in replication connect paths
+* Fixed import/export context leak on failed `initializeRemote` validation
+* Fixed replication catch-up re-sending updates with the original assured flag
+* Prevented rolling back a concurrently adopted generation ID on an aborted handshake
+
+### Directory server fixes
+* Fixed `cn=changelog` search failing when aliases are dereferenced
+* Fixed dereferencing an alias that points into another backend
+* Fixed alias dereferencing dropping entries and accumulating DNs
+* Fixed global `idle-time-limit` having no effect on client connections
+* Fixed race in `TraditionalWorkQueue.isIdle()`
+* Fixed `finalizeWorkQueue` never cancelling queued operations
+* Restored partial import semantics for include/exclude branches
+* Fixed `ArrayIndexOutOfBoundsException` on truncated percent-encoding in LDAP URLs
+* Rejected malformed bracketed IPv6 hosts in `HostPort`
+* Fixed embedded server `rebuildIndex` failing with Connect Error
+* Fixed embedded server setup failing with "Time service not started"
+* Log JMX RMI connector startup failure at error level
+
+### Packaging and distribution
+* Fixed Windows scripts for install paths with spaces and parentheses
+* Fixed duplicate SNMP connection handler entries in the packaged `config.ldif`
+* Fixed duplicate `opendj-server-legacy` classes in the distribution `lib/`
+* Declared the deb/rpm runtime dependencies (`java`, `which`, `chkconfig`)
+* Modernized the OpenDJ Docker images and broadened their multi-architecture build matrix
+* Documented Windows MSI install, upgrade and uninstall
+* Added missing tools references to the documentation
+* Bumped `org.openidentityplatform.commons` to 3.1.2
+
+### Quality and CI
+* Revived, fixed and enabled a large number of previously disabled test suites (ACI, SNMP, quicksetup, replication stress and slow-group tests)
+* Added an OpenDJ vs OpenLDAP LDAP benchmark GitHub Action and PDB vs JE benchmarks
+* Added CI smoke tests for the `addrate`/`authrate`/`modrate`/`searchrate` tools and the Windows MSI install
+* Added CodeQL code scanning and enabled Javadoc doclint
+
+Full changeset ([more details](https://github.com/OpenIdentityPlatform/OpenDJ/compare/5.1.1...5.1.2))
+
+## Thanks for the contributions
+
+<i id="vharseko"><i>1. <a href="https://github.com/vharseko" target="_blank">Valery Kharseko</a></i>
+<br/>
+<i id="maximthomas"><i>2. <a href="https://github.com/maximthomas" target="_blank">Maxim Thomas</a></i>
+<br/>
+<i id="Pig-Tail"><i>3. <a href="https://github.com/Pig-Tail" target="_blank">Thepigtails</a></i>
+<br/>
+<i id="myandrews"><i>4. <a href="https://github.com/myandrews" target="_blank">myandrews</a></i>
+<br/>
+<i id="tonghuaroot"><i>5. <a href="https://github.com/tonghuaroot" target="_blank">tonghuaroot</a></i>
+<br/>
+<i id="wodzen"><i>6. <a href="https://github.com/wodzen" target="_blank">wodzen</a></i>
+<br/>
+<i id="manus-use"><i>7. <a href="https://github.com/manus-use" target="_blank">Jace</a></i>
+<br/>
+<i id="hypnguyen1209"><i>8. <a href="https://github.com/hypnguyen1209" target="_blank">Nguyen Van Hiep</a></i>
+<br/>
+<i id="ldap4life"><i>9. <a href="https://github.com/ldap4life" target="_blank">ldap4life</a></i></i>

_posts/2026-07-20-openam-16-1-2-released.md

@@ -0,0 +1,34 @@
+---
+layout: home
+landing-title: "OpenAM 16.1.2 Released"
+landing-title2: "OpenAM 16.1.2 Released"
+description: OpenAM 16.1.2 with dependency security fixes for js-yaml, ws and websocket-driver, a revocation endpoint in the OpenID Connect discovery document, and an updated embedded OpenDJ 5.1.2
+keywords: 'OpenAM, access management, SSO, release, 16.1.2, security update, CVE-2026-53550, CVE-2026-45736, CVE-2026-48779, CVE-2026-54466, CVE-2026-54490, OpenID Connect, revocation endpoint, OpenDJ 5.1.2'
+imageurl: 'openam-og.png'
+share-buttons: true
+---
+# OpenAM 16.1.2 Released
+[Download](https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2)
+
+## What's new
+* Addressed third-party dependency vulnerabilities:
+    * [CVE-2026-53550](https://github.com/advisories/GHSA-h67p-54hq-rp68) - `js-yaml` quadratic-complexity DoS in merge key handling via repeated aliases
+    * [CVE-2026-45736](https://github.com/advisories/GHSA-58qx-3vcg-4xpx) - `ws` uninitialized memory disclosure
+    * [CVE-2026-48779](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) - `ws` memory exhaustion DoS from tiny fragments and data chunks
+    * [CVE-2026-54466](https://github.com/advisories/GHSA-xv26-6w52-cph6) - `websocket-driver` message corruption via abuse of protocol length headers
+    * [CVE-2026-54490](https://github.com/advisories/GHSA-mp7j-qc5w-4988) - `websocket-driver` resource limit bypass via message compression
+* Added `revocation_endpoint` to the OpenID Connect discovery document
+* Fixed `NotCondition.equals` reflexivity and enabled the OpenFM unit tests
+* Fixed non-resolvable parent POM for the `openam-mcp-server` module
+* Added the `openam-samples` modules to the main reactor
+* Removed the dead `jwt-generator` tool module and the obsolete `openam-test` integration test suite
+* Added CodeQL code scanning and enabled Javadoc doclint on JDK 11 and JDK 26
+* Updated embedded OpenDJ dependency to version 5.1.2
+
+Full changeset ([more details](https://github.com/OpenIdentityPlatform/OpenAM/compare/16.1.1...16.1.2))
+
+## Thanks for the contributions
+
+<i id="vharseko"><i>1. <a href="https://github.com/vharseko" target="_blank">Valery Kharseko</a></i>
+<br/>
+<i id="dairoca90"><i>2. <a href="https://github.com/dairoca90" target="_blank">dairoca90</a></i></i>