REDHAT-BUG-2361633: High severity apache http server vulnerability
Published Apr 22, 2025
·Updated
An unauthenticated attacker can crash the Apache httpd process by sending an empty POST request when OIDCPreservePost is enabled in modauthopenidc. This leads to denial of service.
Affected Software
2 affected components
Apache httpd
Apache mod_auth_openidc
Event History
Apr 22, 2025
Data Sourced
via Red Hat·11:20 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2361633?
The severity of REDHAT-BUG-2361633 is classified as a denial of service vulnerability.
2
Who is impacted by REDHAT-BUG-2361633?
Apache HTTP Server and mod_auth_openidc users with OIDCPreservePost enabled are impacted by REDHAT-BUG-2361633.
3
How does REDHAT-BUG-2361633 affect Apache httpd?
REDHAT-BUG-2361633 allows an unauthenticated attacker to crash the Apache httpd process by sending an empty POST request.
4
How do I fix REDHAT-BUG-2361633?
To fix REDHAT-BUG-2361633, disable OIDCPreservePost in the mod_auth_openidc configuration.
5
What actions should I take upon identifying REDHAT-BUG-2361633 on my server?
Immediately review your Apache httpd configuration and consider disabling OIDCPreservePost to mitigate the vulnerability.