A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
An exception is thrown from a function, but it is not caught.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | - (including) | - (including) |
| Red Hat Enterprise Linux 8 | RedHat | mod_auth_openidc:2.3-8100020250426100353.489197e6 | * |
| Libapache2-mod-auth-openidc | Ubuntu | focal | * |