CVE-2025-3891CWE-248

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

High · published April 29, 2025

CVSS v3.1
7.5
EPSS
2%
Percentile
75.3
In the wild
Unconfirmed
What it is

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01576 · 75.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2025-04-29T11:56Z
EPSS history
Timeline
  • 29 APR 11:56Z
    Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
    cvelistv5