Description
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | mod_auth_openidc | 2.0.0 – < 2.4.13.1 | 2.4.13.1 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-auth-openidc | 2.4.14.2-1 | — |
| Debian 13 | libapache2-mod-auth-openidc | 2.4.14.2-1 | — |
| Debian 12 | libapache2-mod-auth-openidc | 2.4.12.3-2+deb12u4 | DSA-5917-1 |
| Debian 11 | libapache2-mod-auth-openidc | 2.4.9.4-0+deb11u6 | DLA-4155-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 26.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 25.10 | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 24.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 22.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 18.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 16.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | mod_auth_openidc | 2.4.10-1.el9_6.2 | RHSA-2025:9396 |
| RHEL 8 | cjose +1 | 0.6.1-4.module+el8.10.0+21813+b5444eb8 | RHSA-2025:4597 |
| RHEL 8 | mod_auth_openidc | 2.4.9.4-8.module+el8.10.0+23056+decb09b1 | RHSA-2025:4597 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | mod_auth_openidc | 2.4.9.4-4.el9_4.2 | RHSA-2025:10007 |
| RHEL 9.2 E4S | mod_auth_openidc | 2.4.9.4-1.el9_2.3 | RHSA-2025:10008 |
| RHEL 9.0 E4S | mod_auth_openidc | 2.4.9.4-1.el9_0.3 | RHSA-2025:10002 |
| RHEL 8.8 TUS | cjose +1 | 0.6.1-3.module+el8.8.0+19464+578f4546 | RHSA-2025:10010 |
| RHEL 8.8 TUS | mod_auth_openidc | 2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | RHSA-2025:10010 |
| RHEL 8.8 E4S | cjose +1 | 0.6.1-3.module+el8.8.0+19464+578f4546 | RHSA-2025:10010 |
| RHEL 8.8 E4S | mod_auth_openidc | 2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | RHSA-2025:10010 |
| RHEL 8.6 TUS | cjose +1 | 0.6.1-3.module+el8.6.0+19463+7d2e1f9c | RHSA-2025:10003 |
| RHEL 8.6 TUS | mod_auth_openidc | 2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | RHSA-2025:10003 |
| RHEL 8.6 E4S | cjose +1 | 0.6.1-3.module+el8.6.0+19463+7d2e1f9c | RHSA-2025:10003 |
| RHEL 8.6 E4S | mod_auth_openidc | 2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | RHSA-2025:10003 |
| RHEL 8.6 AUS | cjose +1 | 0.6.1-3.module+el8.6.0+19463+7d2e1f9c | RHSA-2025:10003 |
| RHEL 8.6 AUS | mod_auth_openidc | 2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | RHSA-2025:10003 |
| RHEL 8.4 AUS | cjose +1 | 0.6.1-3.module+el8.4.0+19462+14bde120 | RHSA-2025:10004 |
| RHEL 8.4 AUS | mod_auth_openidc | 2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 | RHSA-2025:10004 |
| RHEL 8.2 AUS | cjose +1 | 0.6.1-3.module+el8.2.0+19461+3a40b6ee | RHSA-2025:10006 |
| RHEL 8.2 AUS | mod_auth_openidc | 2.4.9.4-2.module+el8.2.0+23265+3c1fe64f | RHSA-2025:10006 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | mod_auth_openidc | 2.4.10-1.el9_6.2 | ALSA-2025:9396 |
| AlmaLinux 8 | cjose +1 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 | ALSA-2025:4597 |
| AlmaLinux 8 | mod_auth_openidc | 2.4.9.4-8.module_el8.10.0+3988+526f0275 | ALSA-2025:4597 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | mod_auth_openidc | 2.4.10-1.el9_6.2 | RLSA-2025:9396 |
| Rocky Linux 8 | cjose | 0.6.1-4.module+el8.9.0+1384+4b58c166 | RLSA-2025:4597 |
| Rocky Linux 8 | mod_auth_openidc | 2.4.9.4-8.module+el8.10.0+1976+99abe5eb | RLSA-2025:4597 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache2-mod_auth_openidc | 2.3.8-150600.16.11.1 | SUSE-SU-2025:4532-1, SUSE-SU-2025:01953-1 |
| SLES 15 SP6 | apache2-mod_auth_openidc | 2.3.8-150600.16.11.1 | SUSE-SU-2025:4532-1, SUSE-SU-2025:01953-1 |
| SLES 15 SP5 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLES 15 SP4 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLES 15 SP3 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | apache2-mod_auth_openidc | 2.4.0-7.22.1 | SUSE-SU-2025:01585-1 |
| SLES for SAP 15 SP5 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLES for SAP 15 SP4 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLES for SAP 15 SP3 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLE HPC 15 SP5 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLE HPC 15 SP4 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SLE HPC 15 SP3 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SUSE Manager Server 4.3 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SUSE Manager Proxy 4.3 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
| SUSE Enterprise Storage 7.1 | apache2-mod_auth_openidc | 2.3.8-150100.3.34.1 | SUSE-SU-2025:01962-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | apache2-mod_auth_openidc | 2.3.8-150600.16.11.1 | SUSE-SU-2025:4532-1, SUSE-SU-2025:01953-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | mod_auth_openidc | 2.4.10-1.el9_6.2 | ELSA-2025-9396 |
| Oracle Linux 8 | cjose +1 | 0.6.1-4.module+el8.10.0+90549+7b4eddfc | ELSA-2025-4597 |
| Oracle Linux 8 | mod_auth_openidc | 2.4.9.4-8.module+el8.10.0+90568+7a187228 | ELSA-2025-4597 |
Advisories 22
- ALSA-2025:9396 Important: mod_auth_openidc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:4597 Moderate: mod_auth_openidc:2.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:9396 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:4597 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10010 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10007 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10008 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10004 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10006 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10002 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:10003 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- SUSE-SU-2025:01962-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5917-1 libapache2-mod-auth-openidc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4155-1 libapache2-mod-auth-openidc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:4532-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:01953-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:01585-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0956 Red Hat Enterprise Linux (mod_auth_openidc): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Dec 29, 2025
- RLSA-2025:9396 Important: mod_auth_openidc security update Rocky Linux Security Advisories · Oct 9, 2025
- RLSA-2025:4597 Moderate: mod_auth_openidc:2.3 security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-9396 Important: mod_auth_openidc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2025
- ELSA-2025-4597 Moderate: mod_auth_openidc:2.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 7, 2025
References
- RHSA-2025:10002 vendor-advisory
- RHSA-2025:10003 vendor-advisory
- RHSA-2025:10004 vendor-advisory
- RHSA-2025:10006 vendor-advisory
- RHSA-2025:10007 vendor-advisory
- RHSA-2025:10008 vendor-advisory
- RHSA-2025:10010 vendor-advisory
- RHSA-2025:4597 vendor-advisory
- RHSA-2025:9396 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-3891 vdb-entry
- RHBZ#2361633 issue-tracking
- https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b
- https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86