VDB

DEBIAN-CVE-2025-3891

DEBIAN-CVE-2025-3891 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Debian:13libapache2-mod-auth-openidc0, 0
Debian:11libapache2-mod-auth-openidc2.4.9.4-0, 2.4.9-1, 2.4.9.4-0+deb11u1
Debian:12libapache2-mod-auth-openidc2.4.12.3-2, 2.4.12.3-2, 2.4.12.3-2
Debian:14libapache2-mod-auth-openidc0, 0

Timeline

  • Apr 29, 2025 CVE Published
  • Apr 28, 2026 CVE Updated
Open in Interactive Console →
$ Console Community · 100/wk Open console ›