{"id":"CVE-2025-3891","aliases":["ALSA-2025:4597","ALSA-2025:9396","BIT-apache-2025-3891","CLSA-2025-1752247075","DEBIAN-CVE-2025-3891","DLA-4155-1","DSA-5917-1","EUVD-2025-13653","GHSA-v96g-5j57-774c","GHSA-x7cf-8wgv-5j86","RHSA-2025:10002","RHSA-2025:10003","RHSA-2025:10004","RHSA-2025:10006","RHSA-2025:10007","RHSA-2025:10008","RHSA-2025:10010","RHSA-2025:4597","RHSA-2025:9396","RLSA-2025:4597","RLSA-2025:9396","SUSE-SU-2025:01585-1","SUSE-SU-2025:01953-1","SUSE-SU-2025:01962-1","SUSE-SU-2025:4532-1","UBUNTU-CVE-2025-3891"],"status":"published","title":"Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01604,"percentile":0.76048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2025-04-29T11:56:50Z","modified":"2026-11-06T01:21:27Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"cjose","fixed_in":["0.6.1-4.module_el8.9.0+3631+0ced13d7","0.6.1-4.module_el8.10.0+3881+234adf82"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cjose-devel","fixed_in":["0.6.1-4.module_el8.9.0+3631+0ced13d7","0.6.1-4.module_el8.10.0+3881+234adf82"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mod_auth_openidc","fixed_in":["2.4.9.4-8.module_el8.10.0+3988+526f0275"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"mod_auth_openidc","fixed_in":["2.4.10-1.el9_6.2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_auth_openidc","fixed_in":["2.4.9.4-1.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.12.3-2+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9.4-0+deb11u6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-4.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose","fixed_in":["0:0.6.1-4.module+el8.10.0+21813+b5444eb8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-4.module+el8.10.0+21813+b5444eb8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-4.module+el8.10.0+21813+b5444eb8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-4.module+el8.10.0+21813+b5444eb8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-8.module+el8.10.0+23056+decb09b1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-8.module+el8.10.0+23056+decb09b1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-8.module+el8.10.0+23056+decb09b1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.10-1.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.10-1.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.10-1.el9_6.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cjose","fixed_in":["0:0.6.1-4.module+el8.9.0+1384+4b58c166"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-8.module+el8.10.0+1976+99abe5eb"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"mod_auth_openidc","fixed_in":["0:2.4.10-1.el9_6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-7.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-7.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150600.16.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150600.16.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150600.16.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-150100.3.34.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-4.module_el8.9.0+3631+0ced13d7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-4.module_el8.10.0+3881+234adf82"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-4.module_el8.9.0+3631+0ced13d7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-4.module_el8.10.0+3881+234adf82"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-8.module_el8.10.0+3988+526f0275"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-1.el9_6.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache"},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12.3-2+deb12u4"}]}],"versions":["2.4.12.3-2","2.4.12.3-2+deb12u1","2.4.12.3-2+deb12u2","2.4.12.3-2+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-0+deb11u6"}]}],"versions":["2.4.9-1","2.4.9.4-0+deb11u1","2.4.9.4-0+deb11u2","2.4.9.4-0+deb11u3","2.4.9.4-0+deb11u4","2.4.9.4-0+deb11u5"]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12.3-2+deb12u4"}]}],"versions":["2.4.12.3-2","2.4.12.3-2+deb12u1","2.4.12.3-2+deb12u2","2.4.12.3-2+deb12u3"]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+23293+9b46d3da.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+23303+cbb1cd49.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.2.0+19461+3a40b6ee"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-2.module+el8.2.0+23265+3c1fe64f"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-4.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+23294+baa6f818.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-4.module+el8.10.0+21813+b5444eb8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-4.module+el8.10.0+21813+b5444eb8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-4.module+el8.10.0+21813+b5444eb8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-4.module+el8.10.0+21813+b5444eb8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-8.module+el8.10.0+23056+decb09b1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-8.module+el8.10.0+23056+decb09b1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-8.module+el8.10.0+23056+decb09b1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-4.module+el8.9.0+1384+4b58c166"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-8.module+el8.10.0+1976+99abe5eb"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-7.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-7.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150600.16.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150600.16.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150600.16.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-150100.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1","2.3.1-2","2.3.2-1","2.3.2-1build1","2.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10.2-1","2.4.0.4-1","2.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-1","2.4.9.4-1","2.4.10-1","2.4.10-1build1","2.4.11-1","2.4.11-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.14.2-1","2.4.14.4-2","2.4.14.4-2build1","2.4.15.1-1","2.4.15.1-1build2","2.4.15.1-1build3","2.4.15.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.16.10-1","2.4.17-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.18.1-1","2.4.19.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.17-1","2.4.18.1-1"]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"debian","product":"debian_linux"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 advanced update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10002","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10003","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10004","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10006","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10007","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10008","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10010","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4597","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9396","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-3891","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2361633","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","web","report"]},{"url":"https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b","tags":["fix","article"]},{"url":"https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86","tags":["advisory","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00007.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3891","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v96g-5j57-774c"},{"url":"https://bugzilla.redhat.com/2361633","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-4597.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-9396.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1752247075.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3891.json","tags":["advisory"]},{"url":"https://github.com/OpenIDC/mod_auth_openidc","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-3891","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10002.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3891","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10003.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10004.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10006.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10007.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10008.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10010.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4597.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9396.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4597","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9396","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242015","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3891","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501953-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501962-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254532-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31492","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-3891","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-3891","title":"Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T11:56:50.808Z","modified":"2026-11-04T21:29:47.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2025-13653","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T11:56:50Z","modified":"2026-11-04T21:29:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T23:47:19.760967Z"}],"ghsa":[{"id":"GHSA-v96g-5j57-774c","title":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote,...","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T12:30:21Z","modified":"2025-07-28T15:32:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:03:07.9296Z"}],"nvd":[{"id":"CVE-2025-3891","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T12:15:32.137Z","modified":"2026-11-04T22:17:33.443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"CVE-2025-3891","title":"Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T11:56:50.808Z","modified":"2026-11-06T01:21:27.370386231Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-06T02:03:53.554046Z"},{"id":"DEBIAN-CVE-2025-3891","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T12:15:32.137Z","modified":"2026-11-05T09:47:37.699652663Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RHSA-2025:10002","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2025-07-01T10:04:14Z","modified":"2026-08-20T10:09:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10003","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2025-07-01T10:04:15Z","modified":"2026-08-20T10:09:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10004","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2025-07-01T10:04:15Z","modified":"2026-08-20T10:09:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10006","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2025-07-01T10:04:16Z","modified":"2026-08-20T10:09:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10007","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2025-07-01T10:04:17Z","modified":"2026-08-20T10:09:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10008","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2025-07-01T10:04:17Z","modified":"2026-08-20T10:09:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10010","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2025-07-01T10:04:18Z","modified":"2026-08-20T10:09:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:4597","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2025-05-07T10:05:51Z","modified":"2026-08-20T10:10:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:9396","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2025-06-24T10:03:11Z","modified":"2026-08-20T10:10:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:4597","title":"Moderate: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:07.182989Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:9396","title":"Important: mod_auth_openidc security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-09T06:19:05.269728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-3891","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-04-29T12:15:00Z","modified":"2026-10-17T12:57:27.838717777Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:40.454384Z"},{"id":"ALSA-2025:4597","title":"Moderate: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.   \n\nSecurity Fix(es):  \n\n  * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-06T00:00:00Z","modified":"2026-10-29T11:02:23.203534341Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:9396","title":"Important: mod_auth_openidc security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.   \n\nSecurity Fix(es):  \n\n  * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-10-29T11:32:20.260066153Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"BIT-apache-2025-3891","description":"A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.","status":"published","published":"2025-05-13T05:37:35.931Z","modified":"2025-07-28T14:56:48.75613Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2025-1752247075","title":"mod_auth_openidc: Fix of CVE-2025-3891","description":"- CVE-2025-3891: fix denial of service issue caused by sending empty POST\n  request when OIDCPreservePost directive is enabled","status":"published","published":"2025-07-11T15:17:59Z","modified":"2026-06-01T00:30:52.229369955Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"DLA-4155-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2025-05-08T00:00:00Z","modified":"2026-03-09T02:10:07.20108Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5917-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2025-05-08T00:00:00Z","modified":"2026-03-09T02:11:34.198205Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"SUSE-SU-2025:01585-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2025-3891: denial of service via POST requests with an empty Content-Type header and with OIDCPreservePost On\n  (bsc#1242015).\n","status":"published","published":"2025-05-19T17:21:51Z","modified":"2026-02-04T02:17:31.95807Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01953-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2025-3891: Fixed denial of service via an empty POST request when OIDCPreservePost is enabled (bsc#1242015).\n","status":"published","published":"2025-06-13T13:55:31Z","modified":"2026-02-04T03:13:57.102943Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:01962-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2025-3891: Fixed denial of service via an empty POST request when OIDCPreservePost is enabled (bsc#1242015).\n","status":"published","published":"2025-06-16T10:04:07Z","modified":"2026-03-23T04:48:30.587105Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:4532-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- Update to 2.4.17.1 (bsc#1248806 / PED-14130).\n- Remove many patches, as they've been merged upstream.\n  ","status":"published","published":"2025-12-29T13:53:59Z","modified":"2026-02-04T03:27:21.522575Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}