CVE-2025-3891

HIGH

Apache HTTP Server - Denial of Service via Empty POST Request with OIDCPreservePost Enabled

Title source: llm
STIX 2.1

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

References (14)

Core 14
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4597
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10002
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10003
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10004
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10006
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10007
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10008
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:10010
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:9396
Third Party Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-3891
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2361633

Scores

CVSS v3 7.5
EPSS 0.0132
EPSS Percentile 68.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-248
Status published
Products (20)
apache/http_server
debian/debian_linux 11.0
Red Hat/Red Hat Enterprise Linux 10
Red Hat/Red Hat Enterprise Linux 7
Red Hat/Red Hat Enterprise Linux 8 8100020250426100353.489197e6
Red Hat/Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020250612174445.4cda2c84
Red Hat/Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020250618101351.522a0ee4
Red Hat/Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250617090503.ad008a3a
Red Hat/Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250617090503.ad008a3a
Red Hat/Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250617090503.ad008a3a
... and 10 more
Published Apr 29, 2025
Tracked Since Feb 18, 2026