Description
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIDC | mod_auth_openidc | < 2.4.19.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-auth-openidc | 2.4.19.4-1 | — |
| Debian 13 | libapache2-mod-auth-openidc | 2.4.17-1+deb13u1 | — |
| Debian 12 | libapache2-mod-auth-openidc | 2.4.12.3-2+deb12u5 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 24.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 22.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 20.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 18.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | mod_auth_openidc | 2.4.16.11-1.el10_2.1 | RHSA-2026:75581 |
| RHEL 9 | mod_auth_openidc | 2.4.16.11-1.el9_8.1 | RHSA-2026:79177 |
| RHEL 8 | cjose +1 | 0.6.1-5.module+el8.10.0+24880+4db9166e | RHSA-2026:77369 |
| RHEL 8 | mod_auth_openidc | 2.4.9.4-9.module+el8.10.0+24880+4db9166e | RHSA-2026:77369 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | mod_auth_openidc | 2.4.15-4.el10_0.2 | RHSA-2026:69719 |
| RHEL 9.6 EUS | mod_auth_openidc | 2.4.10-1.el9_6.3 | RHSA-2026:69716 |
| RHEL 9.4 E4S | mod_auth_openidc | 2.4.9.4-4.el9_4.3 | RHSA-2026:69718 |
| RHEL 9.2 E4S | mod_auth_openidc | 2.4.9.4-1.el9_2.4 | RHSA-2026:69720 |
| RHEL 8.8 TUS | cjose +1 | 0.6.1-3.module+el8.8.0+19464+578f4546 | RHSA-2026:69717 |
| RHEL 8.8 TUS | mod_auth_openidc | 2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3 | RHSA-2026:69717 |
| RHEL 8.8 E4S | cjose +1 | 0.6.1-3.module+el8.8.0+19464+578f4546 | RHSA-2026:69717 |
| RHEL 8.8 E4S | mod_auth_openidc | 2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3 | RHSA-2026:69717 |
| RHEL 8.6 EUS Long Life | cjose +1 | 0.6.1-3.module+el8.6.0+19463+7d2e1f9c | RHSA-2026:69713 |
| RHEL 8.6 EUS Long Life | mod_auth_openidc | 2.4.9.4-1.module+el8.6.0+24867+df0294a5.3 | RHSA-2026:69713 |
| RHEL 8.6 AUS | cjose +1 | 0.6.1-3.module+el8.6.0+19463+7d2e1f9c | RHSA-2026:69713 |
| RHEL 8.6 AUS | mod_auth_openidc | 2.4.9.4-1.module+el8.6.0+24867+df0294a5.3 | RHSA-2026:69713 |
| RHEL 8.4 EUS Long Life | cjose +1 | 0.6.1-3.module+el8.4.0+19462+14bde120 | RHSA-2026:69712 |
| RHEL 8.4 EUS Long Life | mod_auth_openidc | 2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 | RHSA-2026:69712 |
| RHEL 8.4 AUS | cjose +1 | 0.6.1-3.module+el8.4.0+19462+14bde120 | RHSA-2026:69712 |
| RHEL 8.4 AUS | mod_auth_openidc | 2.4.9.4-1.module+el8.4.0+24868+593d10ef.3 | RHSA-2026:69712 |
| RHEL 7 ELS | mod_auth_openidc | 1.8.8-9.el7_9.2 | RHSA-2026:69715 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | mod_auth_openidc | 2.4.16.11-1.el10_2.1 | ALSA-2026:75581 |
| AlmaLinux 9 | mod_auth_openidc | 2.4.16.11-1.el9_8.1 | ALSA-2026:79177 |
| AlmaLinux 8 | cjose +1 | 0.6.1-5.module_el8.10.0+4297+63ae3533 | ALSA-2026:77369 |
| AlmaLinux 8 | mod_auth_openidc | 2.4.9.4-9.module_el8.10.0+4297+63ae3533 | ALSA-2026:77369 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | mod_auth_openidc | 2.4.16.11-1.el10_2.1 | RLSA-2026:75581 |
| Rocky Linux 9 | mod_auth_openidc | 2.4.16.11-1.el9_8.1 | RLSA-2026:97861, RLSA-2026:79177 |
| Rocky Linux 8 | cjose | 0.6.1-5.module+el8.10.0+40373+8a3f15d2 | RLSA-2026:77369 |
| Rocky Linux 8 | mod_auth_openidc | 2.4.9.4-9.module+el8.10.0+40373+8a3f15d2 | RLSA-2026:77369 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.20.1 | SUSE-SU-2026:3952-1 |
| SLES 15 SP6 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.20.1 | SUSE-SU-2026:3952-1 |
| SLES 15 SP5 | apache2-mod_auth_openidc | 2.4.17.1-150100.3.40.1 | SUSE-SU-2026:3953-1 |
| SLES 15 SP4 | apache2-mod_auth_openidc | 2.4.17.1-150100.3.40.1 | SUSE-SU-2026:3953-1 |
| SLES 12 SP5 | apache2-mod_auth_openidc | 2.4.0-7.25.1 | SUSE-SU-2026:3915-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | apache2-mod_auth_openidc | 2.4.17.1-160000.2.1 | SUSE-SU-2026:23593-1 |
| SLES for SAP 15 SP6 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.20.1 | SUSE-SU-2026:3952-1 |
| SLES for SAP 15 SP5 | apache2-mod_auth_openidc | 2.4.17.1-150100.3.40.1 | SUSE-SU-2026:3953-1 |
| SLES for SAP 15 SP4 | apache2-mod_auth_openidc | 2.4.17.1-150100.3.40.1 | SUSE-SU-2026:3953-1 |
| SLES 16.0 | apache2-mod_auth_openidc | 2.4.17.1-160000.2.1 | SUSE-SU-2026:23593-1 |
| SLE HPC 15 SP5 | apache2-mod_auth_openidc | 2.4.17.1-150100.3.40.1 | SUSE-SU-2026:3953-1 |
| SLE HPC 15 SP4 | apache2-mod_auth_openidc | 2.4.17.1-150100.3.40.1 | SUSE-SU-2026:3953-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_auth_openidc | 2.4.20.2-1.1 | openSUSE-SU-2026:11582-1 |
| openSUSE Leap 16.0 | apache2-mod_auth_openidc | 2.4.17.1-160000.2.1 | openSUSE-SU-2026:21717-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | mod_auth_openidc | 2.4.16.11-1.amzn2023.0.2 | ALAS2023-2026-2155 |
| Amazon Linux 2 | mod_auth_openidc | 1.8.8-7.amzn2.0.1 | ALAS2-2026-3920 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mod_auth_openidc | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | mod_auth_openidc | 2.4.16.11-1.el10_2.1 | ELSA-2026-75581 |
| Oracle Linux 9 | mod_auth_openidc | 2.4.16.11-1.el9_8.1 | ELSA-2026-79177 |
| Oracle Linux 8 | cjose +1 | 0.6.1-5.module+el8.10.0+91060+e975931f | ELSA-2026-77369 |
| Oracle Linux 8 | mod_auth_openidc | 2.4.9.4-9.module+el8.10.0+91060+e975931f | ELSA-2026-77369 |
| Oracle Linux 7 | mod_auth_openidc | 1.8.8-9.0.1.el7_9 | ELSA-2026-69715 |
Advisories 31
- RLSA-2026:97861 Important: mod_auth_openidc security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3492 Red Hat Enterprise Linux (mod_auth_openidc): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:79177 Important: mod_auth_openidc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:75581 Important: mod_auth_openidc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:77369 Important: mod_auth_openidc:2.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:79177 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:77369 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:75581 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69719 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69720 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69717 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69718 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69716 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69713 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69715 Red Hat Security Advisory: mod_auth_openidc security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69712 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- ELSA-2026-79177 Important: mod_auth_openidc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 11, 2026
- RLSA-2026:79177 Important: mod_auth_openidc security update Rocky Linux Security Advisories · Oct 9, 2026
- ELSA-2026-77369 Important: mod_auth_openidc:2.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 9, 2026
- ELSA-2026-69715 Important: mod_auth_openidc security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 9, 2026
- RLSA-2026:77369 Important: mod_auth_openidc:2.3 security update Rocky Linux Security Advisories · Oct 8, 2026
- RLSA-2026:75581 Important: mod_auth_openidc security update Rocky Linux Security Advisories · Oct 6, 2026
- ELSA-2026-75581 Important: mod_auth_openidc security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 5, 2026
- SUSE-SU-2026:23593-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Sep 29, 2026
- ALAS2023-2026-2155 Important: mod_auth_openidc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 14, 2026
- ALAS2-2026-3920 Important: mod_auth_openidc security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 14, 2026
- SUSE-SU-2026:3952-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3953-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3915-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:21717-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Sep 2, 2026
- openSUSE-SU-2026:11582-1 apache2-mod_auth_openidc-2.4.20.2-1.1 on GA media SUSE / openSUSE Security Updates · Aug 26, 2026