Summary
[2.4.10-1.el9_6.2]
Resolves: RHEL-95948 - mod_auth_openidc: DoS via Empty POST in mod_auth_openidc
with OIDCPreservePost Enabled (CVE-2025-3891)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | mod_auth_openidc | 0:2.4.10-1.el9_6.2 |
Vulnerabilities 1
-
High 7.5
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistent…