TI-2025-03438 CVE-2025-3891 · GHSA-v96g-5j57-774c
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
Priority MEDIUM 42
A flaw was found in the mod_auth_openidc module for Apache httpd.
RHSA-2025:10003
mod_auth_openidc:2.3 security update
Released 2025-07-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3 +2
- Red Hat Enterprise Linux AppStream E4S (v.8.6) cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3 +11
- Red Hat Enterprise Linux AppStream TUS (v.8.6) cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3 +2