Read the docs
TI-2024-16331 Aliases CVE-2024-24814

Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0125 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial mod_auth_openidc (OpenIDC): 2.4.15.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenIDCmod_auth_openidc2.0.0 to before 2.4.15.22.4.15.2Patch availableCNA
  • mod_auth_openidc VendorOpenIDC Affected 2.0.0 to before 2.4.15.2 Fixed in 2.4.15.2 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:*2.0.0 – 2.4.15.1VulnerableOpenIDC
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
  • cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.4.15.1 Vulnerable ·OpenIDC
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA mod_auth_openidc (OpenIDC) Fixed in 2.4.15.2

Red Hat 2 advisories

  • RHSA-2024:9180 Released 2024-11-12 · Red Hat rating Moderate
    mod_auth_openidc security update
    • Red Hat Enterprise Linux AppStream (v. 9) mod_auth_openidc-2.4.10-1.el9
  • RHSA-2024:5289 Released 2024-08-13 · Red Hat rating Moderate
    mod_auth_openidc:2.3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) cjose-0.6.1-4.module+el8.10.0+21813+b5444eb8.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-4.module+el8.10.0+21813+b5444eb8.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-4.module+el8.10.0+21813+b5444eb8.s390x::mod_auth_openidc:2.3 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:5289
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:9180

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24814

References

Exploit 1

Patch 1

Advisory 2

  • TI-2017-04220 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
  • TI-2017-03971 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
  • TI-2023-13144 mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied CVSS 3.1HIGH 7.5
  • TI-2017-03968 Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache… CVSS 3.1HIGH 7.5
  • TI-2021-03944 Uncontrolled resource consumption in OpenIDC mod_auth_openidc CVSS 3.1HIGH 7.5
  • TI-2021-12451 Format string bug in the Redis cache implementation CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences