CVE-2025-3891: Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-29 · updated 2026-06-29
Weakness: CWE-248

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Affected products

Apache HTTP Server: all versions
Debian Linux: 11.0
Red Hat Enterprise Linux: 7.0, 8.0, 9.0

References

https://access.redhat.com/errata/RHSA-2025:10002
https://access.redhat.com/errata/RHSA-2025:10003
https://access.redhat.com/errata/RHSA-2025:10004
https://access.redhat.com/errata/RHSA-2025:10006
https://access.redhat.com/errata/RHSA-2025:10007
https://access.redhat.com/errata/RHSA-2025:10008
https://access.redhat.com/errata/RHSA-2025:10010
https://access.redhat.com/errata/RHSA-2025:4597
https://access.redhat.com/errata/RHSA-2025:9396
https://access.redhat.com/security/cve/CVE-2025-3891
https://bugzilla.redhat.com/show_bug.cgi?id=2361633
https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b

Get alerted when CVE-2025-3891 or the next vulnerability affects your stack