Read the docs
TI-2021-12451 Aliases CVE-2021-32785

Format string bug in the Redis cache implementation

Priority LOW 38CWE-134Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-134 and the CVSS impact.

Summary

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.

Why it matters now

EPSS 0.02731 86th percentileScored 2026-11-07
Fix Fixed mod_auth_openidc (zmartzone): 2.4.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenIDCmod_auth_openidcbefore 2.4.92.4.9Patch availableCNA
  • mod_auth_openidc VendorOpenIDC Affected before 2.4.9 Fixed in 2.4.9 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:*before 2.4.9VulnerableOpenIDC
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.0.0 – 2.4.48Running onApache
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:* Versions before 2.4.9 Vulnerable ·OpenIDC
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.4.48 Running on ·Apache
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA mod_auth_openidc (zmartzone) Fixed in 2.4.9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32785

References

Patch 2

Advisory 4

  • TI-2024-16331 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc CVSS 3.1HIGH 7.5
  • TI-2017-04220 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
  • TI-2017-03971 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
  • TI-2023-13144 mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied CVSS 3.1HIGH 7.5
  • TI-2017-03968 Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache… CVSS 3.1HIGH 7.5
  • TI-2021-03944 Uncontrolled resource consumption in OpenIDC mod_auth_openidc CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences