A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:9396 advisory.

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10010 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10003 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10008 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10006 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10007 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10004 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10002 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01962-1 advisory.

    - CVE-2025-3891: Fixed denial of service via an empty POST request when OIDCPreservePost is enabled     (bsc#1242015).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01953-1 advisory.

    - CVE-2025-3891: Fixed denial of service via an empty POST request when OIDCPreservePost is enabled     (bsc#1242015).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-9396 advisory.

    [2.4.10-1.el9_6.2]     Resolves: RHEL-95948 - mod_auth_openidc: DoS via Empty POST in mod_auth_openidc                 with OIDCPreservePost Enabled (CVE-2025-3891)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9396 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:01585-1 advisory.

    - CVE-2025-3891: denial of service via POST requests with an empty Content-Type header and with     OIDCPreservePost On       (bsc#1242015).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0060 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-3891:
    A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote,     unauthenticated attacker to trigger a denial of service by sending an empty POST request when the     OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5917 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5917-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 08, 2025                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libapache2-mod-auth-openidc     CVE ID         : CVE-2025-3891

    A vulnerability has been discovered in mod_auth_openidc, an OpenID     Certified authentication and authorization module for the Apache HTTP     server that implements the OpenID Connect Relying Party functionality:

    An unauthenticated attacker could crash the Apache httpd process by     sending a POST request without a Content-Type header if the     'OIDCPreservePost' directive is enabled, resulting in denial of     service.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.4.12.3-2+deb12u4.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:4597 advisory.

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4155 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4155-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Moritz Schlarb     May 08, 2025                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libapache2-mod-auth-openidc     Version        : 2.4.9.4-0+deb11u6     CVE ID         : CVE-2025-3891     Debian Bug     : 1104484

    A vulnerability has been fixed in mod_auth_openidc, an OpenID Certified     authentication and authorization module for the Apache 2.x HTTP server     that implements the OpenID Connect Relying Party functionality.

    An unauthenticated attacker can crash the Apache httpd process by sending     a POST request without a Content-Type header when OIDCPreservePost is     enabled in mod_auth_openidc. This leads to denial of service.

    A workaround is to disable the OIDCPreservePost directive.

    For Debian 11 bullseye, this problem has been fixed in version     2.4.9.4-0+deb11u6.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-4597 advisory.

    cjose     mod_auth_openidc     [2.4.9.4-8]
    - Resolves: RHEL-87759 - Empty POST causes crash with OIDCPreservePost

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4597 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241252	AlmaLinux 9 : mod_auth_openidc (ALSA-2025:9396)	Nessus	Alma Linux Local Security Checks	high
241030	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:10010)	Nessus	Red Hat Local Security Checks	high
241029	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:10003)	Nessus	Red Hat Local Security Checks	high
241028	RHEL 9 : mod_auth_openidc (RHSA-2025:10008)	Nessus	Red Hat Local Security Checks	high
241027	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:10006)	Nessus	Red Hat Local Security Checks	high
241025	RHEL 9 : mod_auth_openidc (RHSA-2025:10007)	Nessus	Red Hat Local Security Checks	high
241024	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:10004)	Nessus	Red Hat Local Security Checks	high
241021	RHEL 9 : mod_auth_openidc (RHSA-2025:10002)	Nessus	Red Hat Local Security Checks	high
240844	SUSE SLES15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:01962-1)	Nessus	SuSE Local Security Checks	high
240839	SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:01953-1)	Nessus	SuSE Local Security Checks	high
240437	Oracle Linux 9 : mod_auth_openidc (ELSA-2025-9396)	Nessus	Oracle Linux Local Security Checks	high
240279	RHEL 9 : mod_auth_openidc (RHSA-2025:9396)	Nessus	Red Hat Local Security Checks	high
237084	SUSE SLES12 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:01585-1)	Nessus	SuSE Local Security Checks	high
236933	Alibaba Cloud Linux 3 : 0060: mod_auth_openidc:2.3 (ALINUX3-SA-2025:0060)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235620	Debian dsa-5917 : libapache2-mod-auth-openidc - security update	Nessus	Debian Local Security Checks	medium
235601	AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2025:4597)	Nessus	Alma Linux Local Security Checks	medium
235597	Debian dla-4155 : libapache2-mod-auth-openidc - security update	Nessus	Debian Local Security Checks	medium
235472	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2025-4597)	Nessus	Oracle Linux Local Security Checks	high
235447	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:4597)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2025-3891

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

high

high