CVE-2025-3891
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
CVE-2025-3891- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-04
EUVDEUVD-2025-13653
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
EUVD-2025-13653- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-v96g-5j57-774c
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote,...
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
GHSA-v96g-5j57-774c- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-248
- Updated
- 2026-11-02
NVD
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
CVE-2025-3891- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-04
OSV
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
CVE-2025-3891- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2025-3891
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
DEBIAN-CVE-2025-3891- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 20 moreShow less
OSVRHSA-2025:10002
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:10002- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10003
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:10003- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10004
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:10004- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10006
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:10006- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10007
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:10007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10008
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:10008- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10010
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:10010- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:4597
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2025:4597- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:9396
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2025:9396- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2025:4597
Moderate: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:4597- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2025:9396
Important: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:9396- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-3891
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
UBUNTU-CVE-2025-3891- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2025:4597 No score
Moderate: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:4597- Updated
- 2026-11-02
OSVALSA-2025:9396 No score
Important: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:9396- Updated
- 2026-11-02
OSVBIT-apache-2025-3891 No score
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
- Record
BIT-apache-2025-3891- Updated
- 2026-11-02
OSVCLSA-2025-1752247075 No score
mod_auth_openidc: Fix of CVE-2025-3891
- CVE-2025-3891: fix denial of service issue caused by sending empty POST request when OIDCPreservePost directive is enabled
- Record
CLSA-2025-1752247075- Updated
- 2026-11-02
OSVSUSE-SU-2025:01585-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-3891: denial of service via POST requests with an empty Content-Type header and with OIDCPreservePost On (bsc#1242015).
- Record
SUSE-SU-2025:01585-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01953-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-3891: Fixed denial of service via an empty POST request when OIDCPreservePost is enabled (bsc#1242015).
- Record
SUSE-SU-2025:01953-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01962-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2025-3891: Fixed denial of service via an empty POST request when OIDCPreservePost is enabled (bsc#1242015).
- Record
SUSE-SU-2025:01962-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4532-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- Update to 2.4.17.1 (bsc#1248806 / PED-14130).
- Remove many patches, as they've been merged upstream.
- Record
SUSE-SU-2025:4532-1- Updated
- 2026-11-02
Affected products
- apache http server
- debian linux
- red hat enterprise linux 10
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 8.2 advanced update support
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 telecommunications update service
- red hat enterprise linux 8.6 update services for sap solutions
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.10.0+3881+234adf82 | 0.6.1-4.module_el8.10.0+3881+234adf82 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.10.0+3881+234adf82 | 0.6.1-4.module_el8.10.0+3881+234adf82 |
mod_auth_openidcAlmaLinux:8 |
before 2.4.9.4-8.module_el8.10.0+3988+526f0275 | 2.4.9.4-8.module_el8.10.0+3988+526f0275 |
mod_auth_openidcAlmaLinux:9 |
before 2.4.10-1.el9_6.2 | 2.4.10-1.el9_6.2 |
apacheBitnami |
Not stated | Not evaluated |
mod_auth_openidcTuxCare:AlmaLinux:9.2 |
before 2.4.9.4-1.el9.tuxcare.els4 | 2.4.9.4-1.el9.tuxcare.els4 |
libapache2-mod-auth-openidcDebian:12 |
before 2.4.12.3-2+deb12u4, plus listed versions 2.4.12.3-22.4.12.3-2+deb12u12.4.12.3-2+deb12u22.4.12.3-2+deb12u3 |
2.4.12.3-2+deb12u4 |
libapache2-mod-auth-openidcDebian:13 |
before 2.4.14.2-1 | 2.4.14.2-1 |
Show 103 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-openidcDebian:14 |
before 2.4.14.2-1 | 2.4.14.2-1 |
libapache2-mod-auth-openidcDebian:11 |
before 2.4.9.4-0+deb11u6, plus listed versions 2.4.9-12.4.9.4-0+deb11u12.4.9.4-0+deb11u22.4.9.4-0+deb11u32.4.9.4-0+deb11u42.4.9.4-0+deb11u5 |
2.4.9.4-0+deb11u6 |
mod_auth_openidcRed Hat:rhel_e4s:9.0::appstream |
before 0:2.4.9.4-1.el9_0.3 | 0:2.4.9.4-1.el9_0.3 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:9.0::appstream |
before 0:2.4.9.4-1.el9_0.3 | 0:2.4.9.4-1.el9_0.3 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:9.0::appstream |
before 0:2.4.9.4-1.el9_0.3 | 0:2.4.9.4-1.el9_0.3 |
cjoseRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debuginfoRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debugsourceRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-develRed Hat:rhel_aus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
mod_auth_openidcRed Hat:rhel_aus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_aus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_aus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
cjoseRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debuginfoRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debugsourceRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-develRed Hat:rhel_e4s:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
mod_auth_openidcRed Hat:rhel_e4s:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
cjoseRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debuginfoRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-debugsourceRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
cjose-develRed Hat:rhel_tus:8.6::appstream |
before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c |
mod_auth_openidcRed Hat:rhel_tus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_tus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_tus:8.6::appstream |
before 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 | 0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2 |
cjoseRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
cjose-develRed Hat:rhel_aus:8.4::appstream |
before 0:0.6.1-3.module+el8.4.0+19462+14bde120 | 0:0.6.1-3.module+el8.4.0+19462+14bde120 |
mod_auth_openidcRed Hat:rhel_aus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 | 0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 | 0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 | 0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2 |
cjoseRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
cjose-debuginfoRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
cjose-debugsourceRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
cjose-develRed Hat:rhel_aus:8.2::appstream |
before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee |
mod_auth_openidcRed Hat:rhel_aus:8.2::appstream |
before 0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f | 0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f |
mod_auth_openidc-debuginfoRed Hat:rhel_aus:8.2::appstream |
before 0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f | 0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f |
mod_auth_openidc-debugsourceRed Hat:rhel_aus:8.2::appstream |
before 0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f | 0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f |
mod_auth_openidcRed Hat:rhel_eus:9.4::appstream |
before 0:2.4.9.4-4.el9_4.2 | 0:2.4.9.4-4.el9_4.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_eus:9.4::appstream |
before 0:2.4.9.4-4.el9_4.2 | 0:2.4.9.4-4.el9_4.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_eus:9.4::appstream |
before 0:2.4.9.4-4.el9_4.2 | 0:2.4.9.4-4.el9_4.2 |
mod_auth_openidcRed Hat:rhel_e4s:9.2::appstream |
before 0:2.4.9.4-1.el9_2.3 | 0:2.4.9.4-1.el9_2.3 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:9.2::appstream |
before 0:2.4.9.4-1.el9_2.3 | 0:2.4.9.4-1.el9_2.3 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:9.2::appstream |
before 0:2.4.9.4-1.el9_2.3 | 0:2.4.9.4-1.el9_2.3 |
cjoseRed Hat:rhel_e4s:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-debuginfoRed Hat:rhel_e4s:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-debugsourceRed Hat:rhel_e4s:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-develRed Hat:rhel_e4s:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
mod_auth_openidcRed Hat:rhel_e4s:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_e4s:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_e4s:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 |
cjoseRed Hat:rhel_tus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-debuginfoRed Hat:rhel_tus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-debugsourceRed Hat:rhel_tus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
cjose-develRed Hat:rhel_tus:8.8::appstream |
before 0:0.6.1-3.module+el8.8.0+19464+578f4546 | 0:0.6.1-3.module+el8.8.0+19464+578f4546 |
mod_auth_openidcRed Hat:rhel_tus:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 |
mod_auth_openidc-debuginfoRed Hat:rhel_tus:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 |
mod_auth_openidc-debugsourceRed Hat:rhel_tus:8.8::appstream |
before 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 | 0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2 |
cjoseRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-develRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
mod_auth_openidcRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-8.module+el8.10.0+23056+decb09b1 | 0:2.4.9.4-8.module+el8.10.0+23056+decb09b1 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-8.module+el8.10.0+23056+decb09b1 | 0:2.4.9.4-8.module+el8.10.0+23056+decb09b1 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-8.module+el8.10.0+23056+decb09b1 | 0:2.4.9.4-8.module+el8.10.0+23056+decb09b1 |
mod_auth_openidcRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9_6.2 | 0:2.4.10-1.el9_6.2 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9_6.2 | 0:2.4.10-1.el9_6.2 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9_6.2 | 0:2.4.10-1.el9_6.2 |
cjoseRocky Linux:8 |
before 0:0.6.1-4.module+el8.9.0+1384+4b58c166 | 0:0.6.1-4.module+el8.9.0+1384+4b58c166 |
mod_auth_openidcRocky Linux:8 |
before 0:2.4.9.4-8.module+el8.10.0+1976+99abe5eb | 0:2.4.9.4-8.module+el8.10.0+1976+99abe5eb |
mod_auth_openidcRocky Linux:9 |
before 0:2.4.10-1.el9_6.2 | 0:2.4.10-1.el9_6.2 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 2.4.0-7.22.1 | 2.4.0-7.22.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.4.0-7.22.1 | 2.4.0-7.22.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.3.8-150600.16.11.1 | 2.3.8-150600.16.11.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.3.8-150600.16.11.1 | 2.3.8-150600.16.11.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.3.8-150600.16.11.1 | 2.3.8-150600.16.11.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Manager Proxy 4.3 |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Manager Server 4.3 |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Enterprise Storage 7.1 |
before 2.3.8-150100.3.34.1 | 2.3.8-150100.3.34.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
libapache2-mod-auth-openidcUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.8.5-1 |
None known |
libapache2-mod-auth-openidcUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-12.3.1-22.3.2-12.3.2-1build12.3.3-1build1 |
None known |
libapache2-mod-auth-openidcUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.10.2-12.4.0.4-12.4.1-1 |
None known |
libapache2-mod-auth-openidcUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.9-12.4.9.4-12.4.10-12.4.10-1build12.4.11-12.4.11-1ubuntu0.1 |
None known |
libapache2-mod-auth-openidcUbuntu:24.04:LTS |
All versions, plus listed versions 2.4.14.2-12.4.14.4-22.4.14.4-2build12.4.15.1-12.4.15.1-1build22.4.15.1-1build32.4.15.1-1ubuntu0.1 |
None known |
libapache2-mod-auth-openidcUbuntu:25.10 |
All versions, plus listed versions 2.4.16.10-12.4.17-1 |
None known |
libapache2-mod-auth-openidcUbuntu:26.10 |
All versions, plus listed versions 2.4.18.1-12.4.19.4-1build1 |
None known |
libapache2-mod-auth-openidcUbuntu:26.04:LTS |
All versions, plus listed versions 2.4.17-12.4.18.1-1 |
None known |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3891 is a high vulnerability (CVSS 7.5) in Apache Http Server, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in cjose 0.6.1-4.module_el8.9.0+3631+0ced13d7.
References
access.redhat.com/errata/RHSA-2025:10002
Show 50 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2361633
github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b
lists.debian.org/debian-lts-announce/2025/05/msg00007.html
nvd.nist.gov/vuln/detail/CVE-2025-3891
errata.almalinux.org/8/ALSA-2025-4597.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1752247075.html
security-tracker.debian.org/tracker/CVE-2025-3891
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10002.json
cve.org/CVERecord?id=CVE-2025-3891
errata.rockylinux.org/RLSA-2025:4597
suse.com/support/update/announcement/2025/suse-su-202501585-1
bugzilla.suse.com/1242015
ubuntu.com/security/CVE-2025-3891