RLSA-2026:97861: Important: mod_auth_openidc security update
The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/mod_auth_openidcto a version that resolves this vulnerability.Fixed in 0:2.4.16.11-2.el9_9 - Upgrade
Upgrade
rocky-linux/mod_auth_openidc-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.4.16.11-2.el9_9 - Upgrade
Upgrade
rocky-linux/mod_auth_openidc-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.4.16.11-2.el9_9
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it over the network. No privileges or user interaction are required.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service. The provided CVSS vector indicates availability impact only, with no stated confidentiality or integrity impact.
Which deployments are exposed?
Deployments using mod_auth_openidc on Apache HTTP Server are relevant, particularly where the module processes OpenID Connect state cookies. The advisory does not provide configuration-specific conditions or affected version ranges.
How can I tell whether my system is affected?
Check whether the Rocky Linux packages mod_auth_openidc, mod_auth_openidc-debuginfo, or mod_auth_openidc-debugsource are installed. The advisory does not provide vulnerable or fixed package versions, so version-level determination is not possible from the supplied information.