{"id":"CVE-2021-20718","aliases":["AZL-7288","DEBIAN-CVE-2021-20718","EUVD-2021-8132","MGASA-2021-0280","SUSE-SU-2021:1900-1","UBUNTU-CVE-2021-20718"],"status":"published","title":"CVE-2021-20718 affecting package mod_auth_openidc for versions less than 2.4.14.2-1","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03395,"percentile":0.88929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-05-20T01:15:21Z","modified":"2026-10-24T10:50:04Z","fixes":[{"ecosystem":"Azure Linux:2","package":"mod_auth_openidc","fixed_in":["2.4.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.4.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.4.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.4.1-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"apache-mod_auth_openidc","fixed_in":["2.4.2.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4.1-2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"apache-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10.2-1","2.4.0.4-1","2.4.1-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openidc","product":"mod_auth_openidc"},{"vendor":"oracle","product":"essbase"},{"vendor":"zmartzone","product":"mod_auth_openidc"}],"references":[{"url":"https://www.zmartzone.eu/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","report"]},{"url":"https://jvn.jp/en/jp/JVN49704918/index.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FV4KYMQWPS3I2QPW2C253MLIAFGBZPLK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HJK366TLFEOIYWTHQSZO24MSDPBXHJU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20718","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-20718","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29103","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-June/008962.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5HJK366TLFEOIYWTHQSZO24MSDPBXHJU/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211900-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20718","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-20718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20718","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-20718","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T01:15:21Z","modified":"2024-08-03T17:53:21.241Z","updated_at":"2026-11-02T14:32:55.19484Z"}],"euvd":[{"id":"EUVD-2021-8132","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T01:15:21Z","modified":"2024-08-03T17:53:21Z","updated_at":"2026-11-03T03:25:08.33351Z"}],"nvd":[{"id":"CVE-2021-20718","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T02:15:07.117Z","modified":"2026-06-17T03:34:18.83Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"AZL-7288","title":"CVE-2021-20718 affecting package mod_auth_openidc for versions less than 2.4.14.2-1","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T02:15:07Z","modified":"2026-04-21T04:33:44.718351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-20718","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T02:15:07.117Z","modified":"2026-10-24T10:50:04.366879552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-20718","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T02:15:07.117Z","modified":"2026-10-23T18:03:10.481529711Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-20718","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.","status":"published","published":"2021-05-20T02:15:00Z","modified":"2025-10-24T04:50:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"MGASA-2021-0280","title":"Updated apache-mod_auth_openidc package fixes a security vulnerability","description":"mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-\nservice (DoS) condition via unspecified vectors (CVE-2021-20718).\n","status":"published","published":"2021-06-23T17:11:28Z","modified":"2026-04-16T04:44:34.892932616Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"SUSE-SU-2021:1900-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-20718: Fixed possible remote denial-of-service (DoS) via unspecified vectors (bsc#1186291).\n","status":"published","published":"2021-06-08T17:30:07Z","modified":"2026-02-04T03:09:21.076882Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}