CVE-2025-3891

HIGH

Apache HTTP Server - Denial of Service

Title source: rule

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

References (14)

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10002

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2025:4597

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:9396

[Third Party Advisory] https://access.redhat.com/security/cve/CVE-2025-3891

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=2361633

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2025/05/msg00007.html

[Patch] https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b

View Patch ZIP pw:eip

[Vendor Advisory] https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10008

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10010

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10003

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10004

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10006

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:10007

Scores

CVSS v3 7.5

EPSS 0.0133

EPSS Percentile 79.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-248

Status published

Affected Products (5)

apache/http_server

redhat/enterprise_linux

redhat/enterprise_linux

redhat/enterprise_linux

debian/debian_linux

Timeline

Published Apr 29, 2025

Tracked Since Feb 18, 2026