Skip to content
OpenAdvisories
High ELSA-2026-77369 2 CVEs

Important: mod_auth_openidc:2.3 security update (Oracle Linux 8)

Published Oct 9, 2026 · Updated Oct 9, 2026

Ecosystem: Oracle Linux

Summary

cjose
[0.6.1-5]
- CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap
Resolves: RHEL-256961

mod_auth_openidc
[2.4.9.4-9]
- Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state
cookie parsing

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 cjose 0:0.6.1-5.module+el8.10.0+91060+e975931f
Oracle Linux · 8 cjose-devel 0:0.6.1-5.module+el8.10.0+91060+e975931f
Oracle Linux · 8 mod_auth_openidc 0:2.4.9.4-9.module+el8.10.0+91060+e975931f

Vulnerabilities 2

  • High 8.2
    CVE-2026-53938

    OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the le…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-54789

    mod_auth_openidc has out-of-bounds read and write in state cookie parsing

    mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in…

    OpenIDC mod_auth_openidc libapache2-mod-auth-openidc libapache2-mod-auth-openidc Debian Ubuntu Azure Linux