From 59003481740e601dabce06869b85cac4264ea541 Mon Sep 17 00:00:00 2001
From: Joe Grandja <10884212+jgrandja@users.noreply.github.com>
Date: Fri, 10 Jul 2026 10:42:39 -0400
Subject: [PATCH] Bind UnboundIdContainer to loopback address

---
 .../LdapAuthenticationProviderConfigurer.java |  3 ++-
 .../ldap/LdapServerBeanDefinitionParser.java  |  3 ++-
 .../ldap/server/UnboundIdContainerTests.java  | 20 +++++++++++++++++++
 .../ldap/server/UnboundIdContainer.java       |  4 +++-
 4 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java
index d8fd2cd211..80a32e285a 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java
@@ -17,6 +17,7 @@
 package org.springframework.security.config.annotation.authentication.configurers.ldap;
 
 import java.io.IOException;
+import java.net.InetAddress;
 import java.net.ServerSocket;
 
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
@@ -590,7 +591,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		}
 
 		private int getDefaultPort() {
-			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
+			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
 				return serverSocket.getLocalPort();
 			}
 			catch (IOException ex) {
diff --git a/config/src/main/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParser.java
index 74bc65e05d..177d9ce334 100644
--- a/config/src/main/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParser.java
+++ b/config/src/main/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParser.java
@@ -17,6 +17,7 @@
 package org.springframework.security.config.ldap;
 
 import java.io.IOException;
+import java.net.InetAddress;
 import java.net.ServerSocket;
 
 import org.w3c.dom.Element;
@@ -188,7 +189,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 	}
 
 	private String getDefaultPort() {
-		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
+		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
 			return String.valueOf(serverSocket.getLocalPort());
 		}
 		catch (IOException ex) {
diff --git a/ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerTests.java b/ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerTests.java
index 070f339b75..99e1efadc3 100644
--- a/ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerTests.java
+++ b/ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerTests.java
@@ -21,9 +21,11 @@ import java.net.ServerSocket;
 import java.util.ArrayList;
 import java.util.List;
 
+import com.unboundid.ldap.listener.InMemoryDirectoryServer;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.context.support.GenericApplicationContext;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -48,6 +50,24 @@ public class UnboundIdContainerTests {
 		}
 	}
 
+	@Test
+	public void startLdapServerThenListenerBindsToLoopbackAddressOnly() throws Exception {
+		UnboundIdContainer server = new UnboundIdContainer("dc=springframework,dc=org", null);
+		server.setApplicationContext(new GenericApplicationContext());
+		List<Integer> ports = getDefaultPorts(1);
+		server.setPort(ports.get(0));
+
+		try {
+			server.afterPropertiesSet();
+			InMemoryDirectoryServer directoryServer = (InMemoryDirectoryServer) ReflectionTestUtils.getField(server,
+					"directoryServer");
+			assertThat(directoryServer.getListenAddress().isLoopbackAddress()).isTrue();
+		}
+		finally {
+			server.destroy();
+		}
+	}
+
 	@Test
 	public void afterPropertiesSetWhenPortIsZeroThenRandomPortIsSelected() throws Exception {
 		UnboundIdContainer server = new UnboundIdContainer("dc=springframework,dc=org", null);
diff --git a/ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java b/ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java
index ec0efba60b..e069affe2d 100644
--- a/ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java
+++ b/ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java
@@ -17,6 +17,7 @@
 package org.springframework.security.ldap.server;
 
 import java.io.InputStream;
+import java.net.InetAddress;
 
 import com.unboundid.ldap.listener.InMemoryDirectoryServer;
 import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
@@ -96,7 +97,8 @@ public class UnboundIdContainer
 		try {
 			InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(this.defaultPartitionSuffix);
 			config.addAdditionalBindCredentials("uid=admin,ou=system", "secret");
-			config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("LDAP", this.port));
+			config.setListenerConfigs(
+					InMemoryListenerConfig.createLDAPConfig("LDAP", InetAddress.getLoopbackAddress(), this.port, null));
 			config.setEnforceSingleStructuralObjectClass(false);
 			config.setEnforceAttributeSyntaxCompliance(true);
 			DN dn = new DN(this.defaultPartitionSuffix);