CVE-2025-3891: Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the modauthopenidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Other sources
An unauthenticated attacker can crash the Apache httpd process by sending an empty POST request when OIDCPreservePost is enabled in modauthopenidc. This leads to denial of service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libapache2-mod-auth-openidcto a version that resolves this vulnerability.Fixed in 2.4.9.4-0+deb11u6Fixed in 2.4.12.3-2+deb12u4Fixed in 2.4.17-1Fixed in 2.4.18.1-1 - Upgrade
Upgrade
debian/libapache2-mod-auth-openidcto a version that resolves this vulnerability.Fixed in 2.4.12.3-2+deb12u4Fixed in 2.4.9.4-0+deb11u6Fixed in 2.4.14.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3891?
CVE-2025-3891 is considered a critical vulnerability that allows remote, unauthenticated attackers to trigger a denial of service.
How do I fix CVE-2025-3891?
To mitigate CVE-2025-3891, disable the OIDCPreservePost directive in the mod_auth_openidc configuration for Apache httpd.
What impact does CVE-2025-3891 have on my system?
CVE-2025-3891 can cause the Apache server to crash, resulting in a loss of availability for services relying on it.
Which versions of Apache httpd are affected by CVE-2025-3891?
CVE-2025-3891 affects all versions of Apache httpd that utilize the mod_auth_openidc module with the OIDCPreservePost directive enabled.
Can CVE-2025-3891 be exploited remotely?
Yes, CVE-2025-3891 can be exploited remotely by an unauthenticated attacker sending an empty POST request.