Description
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- apache / http_server
- debian / debian_linux11.0 – 11.0
- RedHat / enterprise_linux7.0 – 7.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux9.0 – 9.0
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10002
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10003
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10004
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10006
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10007
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10008
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10010
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:4597
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:9396
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2025-3891
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2361633
- PATCHhttps://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b
- VENDOR_ADVISORYhttps://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86
Updated 8m ago · 8 sources