CVE-2025-3891

Published: Apr 29, 2025

Modified: Nov 11, 2025

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Vendor	Product	Versions
Unknown	mod_auth_openidc	affected `2.0.0 - < 2.4.13.1`
Red Hat	Red Hat Enterprise Linux 8	unaffected `8100020250426100353.489197e6 - < *`
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected `8020020250612174445.4cda2c84 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected `8040020250618101351.522a0ee4 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected `8060020250617090503.ad008a3a - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected `8060020250617090503.ad008a3a - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected `8060020250617090503.ad008a3a - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected `8080020250617090716.63b34585 - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected `8080020250617090716.63b34585 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:2.4.10-1.el9_6.2 - < *`
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	unaffected `0:2.4.9.4-1.el9_0.3 - < *`
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	unaffected `0:2.4.9.4-1.el9_2.3 - < *`
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected `0:2.4.9.4-4.el9_4.2 - < *`
Red Hat	Red Hat Enterprise Linux 10	All versions
Red Hat	Red Hat Enterprise Linux 7	All versions