CVE-2026-54789

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).

Security Fix(es):

An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. oidc_state_cookies_parse_token() (src/state.c) scans a cookie token for the = that separates the cookie name from its value with a loop whose only real termination condition is finding a = byte — it does not stop at the string terminator. The cookie != NULL test can never become false, because cookie is only ever incremented (never reassigned to NULL). A request whose Cookie header contains a token that begins with the configured state-cookie prefix (default mod_auth_openidc_state_) but contains no = makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a = (0x3D) byte, and then writing a NUL byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the OIDCRedirectURI callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the Cookie header.(CVE-2026-54789)

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).

Security Fix(es):

An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. oidc_state_cookies_parse_token() (src/state.c) scans a cookie token for the = that separates the cookie name from its value with a loop whose only real termination condition is finding a = byte — it does not stop at the string terminator. The cookie != NULL test can never become false, because cookie is only ever incremented (never reassigned to NULL). A request whose Cookie header contains a token that begins with the configured state-cookie prefix (default mod_auth_openidc_state_) but contains no = makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a = (0x3D) byte, and then writing a NUL byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the OIDCRedirectURI callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the Cookie header.(CVE-2026-54789)

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).

Security Fix(es):

An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. oidc_state_cookies_parse_token() (src/state.c) scans a cookie token for the = that separates the cookie name from its value with a loop whose only real termination condition is finding a = byte — it does not stop at the string terminator. The cookie != NULL test can never become false, because cookie is only ever incremented (never reassigned to NULL). A request whose Cookie header contains a token that begins with the configured state-cookie prefix (default mod_auth_openidc_state_) but contains no = makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a = (0x3D) byte, and then writing a NUL byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the OIDCRedirectURI callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the Cookie header.(CVE-2026-54789)

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

• mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

• mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)

• cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

• mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed Cookie headers (tokens lacking =) can reduce exposure, but upgrading is the recommended remediation.

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

• mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

• mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)
• cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

• mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed Cookie headers (tokens lacking =) can reduce exposure, but upgrading is the recommended remediation.

• CVE-2026-54789: stop the state-cookie scan at the end of the cookie token so a state cookie without '=' cannot cause an out-of-bounds read/write

• CVE-2026-54789: fix out-of-bounds read/write in the state-cookie parser

Out-of-bounds read and write in state cookie parsing. (CVE-2026-54789)

These are all security issues fixed in the apache2-mod_auth_openidc-2.4.20.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache2-mod_auth_openidc fixes the following issue:

• CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of mod_auth_openidc (bsc#1276217).

This update for apache2-mod_auth_openidc fixes the following issue:

• CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of mod_auth_openidc (bsc#1276217).

This update for apache2-mod_auth_openidc fixes the following issue:

• CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of mod_auth_openidc (bsc#1276217).

This update for apache2-mod_auth_openidc fixes the following issue:

• CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of mod_auth_openidc (bsc#1276217).

This update for apache2-mod_auth_openidc fixes the following issue:

• CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of mod_auth_openidc (bsc#1276217).