Summary
[2.4.16.11-1.1]
- Resolves: RHEL-248048 - CVE-2026-54789 out-of-bounds read/write
in oidc_state_cookies_clean_expired when a state-prefixed cookie
token contains no '=' separator
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | mod_auth_openidc | 0:2.4.16.11-1.el9_8.1 |
Vulnerabilities 1
-
High 7.5
mod_auth_openidc has out-of-bounds read and write in state cookie parsing
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in…