{"id":"CVE-2026-54789","aliases":["ALSA-2026:75581","ALSA-2026:77369","ALSA-2026:79177","AZL-96984","CLSA-2026-1791839568","CLSA-2026-1792634626","DEBIAN-CVE-2026-54789","EUVD-2026-64000","GHSA-vgr5-qcpp-x2pr","MGASA-2026-0381","OESA-2026-3009","OESA-2026-3010","OESA-2026-3011","OESA-2026-3012","RHSA-2026:69712","RHSA-2026:69713","RHSA-2026:69715","RHSA-2026:69716","RHSA-2026:69717","RHSA-2026:69718","RHSA-2026:69719","RHSA-2026:69720","RHSA-2026:75581","RHSA-2026:77369","RHSA-2026:79177","RLSA-2026:75581","RLSA-2026:77369","RLSA-2026:79177","SUSE-SU-2026:23593-1","SUSE-SU-2026:3915-1","SUSE-SU-2026:3952-1","SUSE-SU-2026:3953-1","UBUNTU-CVE-2026-54789","openSUSE-SU-2026:11582-1","openSUSE-SU-2026:21717-1"],"status":"published","title":"mod_auth_openidc has out-of-bounds read and write in state cookie parsing","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00488,"percentile":0.42559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2026-07-19T11:11:54Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"mod_auth_openidc","fixed_in":["2.4.16.11-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"mod_auth_openidc","fixed_in":["2.4.16.11-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_auth_openidc","fixed_in":["2.4.9.4-1.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_auth_openidc","fixed_in":["2.4.10-1.el9_6.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.12.3-2+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.17-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.19.4-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"apache-mod_auth_openidc","fixed_in":["2.4.20.2-1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"apache-mod_auth_openidc","fixed_in":["2.4.20.2-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mod_auth_openidc","fixed_in":["2.4.19.4-1.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"mod_auth_openidc","fixed_in":["2.4.19.4-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"mod_auth_openidc","fixed_in":["2.4.19.4-1.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"mod_auth_openidc","fixed_in":["2.4.19.4-1.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.4.0+19462+14bde120"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"mod_auth_openidc","fixed_in":["0:1.8.8-9.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"mod_auth_openidc-debuginfo","fixed_in":["0:1.8.8-9.el7_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.10-1.el9_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.10-1.el9_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.10-1.el9_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debuginfo","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debugsource","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-devel","fixed_in":["0:0.6.1-3.module+el8.8.0+19464+578f4546"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-4.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-4.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-4.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_auth_openidc","fixed_in":["0:2.4.15-4.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.15-4.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.15-4.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.9.4-1.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.9.4-1.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.9.4-1.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_auth_openidc","fixed_in":["0:2.4.16.11-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.16.11-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.16.11-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc","fixed_in":["0:2.4.16.11-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debuginfo","fixed_in":["0:2.4.16.11-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debugsource","fixed_in":["0:2.4.16.11-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"mod_auth_openidc","fixed_in":["0:2.4.16.11-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"mod_auth_openidc","fixed_in":["0:2.4.16.11-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-7.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-7.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150600.16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150600.16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150600.16.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-150100.3.40.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_auth_openidc","fixed_in":["2.4.20.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"apache2-mod_auth_openidc","fixed_in":["2.4.17.1-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16.11-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-5.module_el8.10.0+4297+63ae3533"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-5.module_el8.10.0+4297+63ae3533"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-9.module_el8.10.0+4297+63ae3533"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16.11-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.14.2-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-1.el9_6.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12.3-2+deb12u5"}]}],"versions":["2.4.12.3-2","2.4.12.3-2+deb12u1","2.4.12.3-2+deb12u2","2.4.12.3-2+deb12u3","2.4.12.3-2+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-1+deb13u1"}]}],"versions":["2.4.17-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19.4-1"}]}],"versions":["2.4.17-1","2.4.17.2-1","2.4.18-1","2.4.18.1-1","2.4.19-1","2.4.19.1-1","2.4.19.1-2","2.4.19.2-1","2.4.19.2-2","2.4.19.2-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"apache-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20.2-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"apache-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20.2-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19.4-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19.4-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19.4-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19.4-1.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.4.0+19462+14bde120"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.8-9.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.8-9.el7_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-1.el9_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.module+el8.8.0+19464+578f4546"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-4.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-4.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-4.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.15-4.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.15-4.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.15-4.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-1.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-5.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-5.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-5.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-5.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-9.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-9.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-9.module+el8.10.0+24880+4db9166e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-5.module+el8.10.0+40373+8a3f15d2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9.4-9.module+el8.10.0+40373+8a3f15d2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.16.11-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-7.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-7.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150100.3.40.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1","2.3.1-2","2.3.2-1","2.3.2-1build1","2.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10.2-1","2.4.0.4-1","2.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-1","2.4.9.4-1","2.4.10-1","2.4.10-1build1","2.4.11-1","2.4.11-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.14.2-1","2.4.14.4-2","2.4.14.4-2build1","2.4.15.1-1","2.4.15.1-1build2","2.4.15.1-1build3","2.4.15.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.17-1","2.4.18.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-160000.2.1"}]}]}],"products":[{"vendor":"openidc","product":"mod_auth_openidc"},{"vendor":"zmartzone","product":"mod_auth_openidc"}],"references":[{"url":"https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-vgr5-qcpp-x2pr","tags":["x_refsource_CONFIRM","advisory","article","report"]},{"url":"https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be652a73a8630","tags":["x_refsource_MISC","fix","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/09/msg00003.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75581","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54789","tags":["report"]},{"url":"https://bugzilla.redhat.com/2521051","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-75581.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77369","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53938","tags":["report"]},{"url":"https://bugzilla.redhat.com/2530240","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-77369.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79177","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-79177.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54789","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791839568.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792634626.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54789.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54789","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0381.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36209","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DJLYJS22XN3IFTMN7F46SPHFLF7J6355/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3009","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3010","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3011","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3012","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69712","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521051","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69712.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54789","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69713","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69713.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69715","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69715.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69716","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69716.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69717","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69717.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69718","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69718.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69719","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69719.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69720","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69720.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75581.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530240","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77369.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53938","tags":["advisory"]},{"url":"https://github.com/OpenIDC/cjose/commit/8c51d245273583a658f24ef7b08ba22f848a34a5","tags":["article"]},{"url":"https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79177.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:75581","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:77369","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:79177","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623593-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54789","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263915-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263952-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263953-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54789","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54789","title":"mod_auth_openidc has out-of-bounds read and write in state cookie parsing","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:13:23.073Z","modified":"2026-09-02T19:06:57.449Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-64000","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:13:23Z","modified":"2026-09-02T19:06:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"nvd":[{"id":"CVE-2026-54789","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:17:19Z","modified":"2026-10-15T19:10:00.173Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-54789","title":"mod_auth_openidc has out-of-bounds read and write in state cookie parsing","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:13:23.073Z","modified":"2026-11-11T13:26:44.340776561Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-11T03:21:28.618498Z"},{"id":"DEBIAN-CVE-2026-54789","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:17:19Z","modified":"2026-10-16T09:47:23.184558424Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-3009","title":"mod_auth_openidc security update","description":"This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.167807934Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3010","title":"mod_auth_openidc security update","description":"This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.178640532Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3011","title":"mod_auth_openidc security update","description":"This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.156132825Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3012","title":"mod_auth_openidc security update","description":"This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.248142558Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:69712","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2026-09-22T10:20:08Z","modified":"2026-10-15T10:25:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69713","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2026-09-22T10:20:09Z","modified":"2026-10-15T10:25:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69715","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-09-22T10:20:10Z","modified":"2026-10-15T10:25:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69716","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-09-22T10:20:10Z","modified":"2026-10-15T10:25:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69717","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2026-09-22T10:20:11Z","modified":"2026-10-15T10:25:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69718","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-09-22T10:20:11Z","modified":"2026-10-15T10:25:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69719","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-09-22T10:20:12Z","modified":"2026-10-15T10:25:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69720","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-09-22T10:20:12Z","modified":"2026-10-15T10:25:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:75581","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-10-06T10:18:59Z","modified":"2026-10-15T10:27:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:77369","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security update","status":"published","published":"2026-10-08T10:20:18Z","modified":"2026-10-15T10:27:36Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:79177","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2026-10-10T10:22:47Z","modified":"2026-10-15T10:27:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:75581","title":"Important: mod_auth_openidc security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-06T12:10:42.614631Z","modified":"2026-10-06T12:45:02.670366413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:77369","title":"Important: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)\n\n* cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-08T06:03:37.805664Z","modified":"2026-10-08T06:45:02.751660331Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:79177","title":"Important: mod_auth_openidc security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-09T12:05:31.687519Z","modified":"2026-10-09T12:45:02.563890043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-54789","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:17:00Z","modified":"2026-09-02T19:36:19.466314362Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:75581","title":"Important: mod_auth_openidc security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.   \n\nSecurity Fix(es):  \n\n  * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-29T11:30:51.579086969Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:77369","title":"Important: mod_auth_openidc:2.3 security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.   \n\nSecurity Fix(es):  \n\n  * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)\n  * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-07T00:00:00Z","modified":"2026-10-29T11:02:29.605266195Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:79177","title":"Important: mod_auth_openidc security update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.   \n\nSecurity Fix(es):  \n\n  * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T11:32:38.076162204Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-96984","title":"CVE-2026-54789 affecting package mod_auth_openidc 2.4.14.2-2","description":"mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.","status":"published","published":"2026-08-21T16:17:19Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1791839568","title":"mod_auth_openidc: Fix of CVE-2026-54789","description":"- CVE-2026-54789: stop the state-cookie scan at the end of the cookie token so\n  a state cookie without '=' cannot cause an out-of-bounds read/write","status":"published","published":"2026-10-12T21:12:58Z","modified":"2026-10-26T09:30:39.09971577Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792634626","title":"mod_auth_openidc: Fix of CVE-2026-54789","description":"- CVE-2026-54789: fix out-of-bounds read/write in the state-cookie parser","status":"published","published":"2026-10-22T02:03:56Z","modified":"2026-10-26T09:31:36.612470758Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"MGASA-2026-0381","title":"Updated apache-mod_auth_openidc packages fix a security vulnerability","description":"Out-of-bounds read and write in state cookie parsing. (CVE-2026-54789)\n","status":"published","published":"2026-09-07T18:46:11Z","modified":"2026-09-07T19:00:02.616522897Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11582-1","title":"apache2-mod_auth_openidc-2.4.20.2-1.1 on GA media","description":"These are all security issues fixed in the apache2-mod_auth_openidc-2.4.20.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-24T00:00:00Z","modified":"2026-08-26T18:23:37.041208787Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21717-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issue:\n\n- CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc`\n  (bsc#1276217).\n","status":"published","published":"2026-09-01T09:57:24Z","modified":"2026-09-02T18:00:03.398907894Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23593-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issue:\n\n- CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc`\n  (bsc#1276217).\n","status":"published","published":"2026-09-01T09:55:56Z","modified":"2026-09-29T18:23:18.702764976Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3915-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issue:\n\n- CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc`\n  (bsc#1276217).\n","status":"published","published":"2026-09-01T14:57:04Z","modified":"2026-09-10T18:23:20.863752869Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3952-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issue:\n\n- CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc`\n  (bsc#1276217).\n","status":"published","published":"2026-09-03T07:43:49Z","modified":"2026-09-10T18:24:10.603805077Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3953-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issue:\n\n- CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc`\n  (bsc#1276217).\n","status":"published","published":"2026-09-03T07:45:21Z","modified":"2026-09-10T18:23:22.473536513Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}