A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:01585-1 advisory.

    - CVE-2025-3891: denial of service via POST requests with an empty Content-Type header and with     OIDCPreservePost On       (bsc#1242015).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0060 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-3891:
    A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote,     unauthenticated attacker to trigger a denial of service by sending an empty POST request when the     OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5917 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5917-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 08, 2025                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libapache2-mod-auth-openidc     CVE ID         : CVE-2025-3891

    A vulnerability has been discovered in mod_auth_openidc, an OpenID     Certified authentication and authorization module for the Apache HTTP     server that implements the OpenID Connect Relying Party functionality:

    An unauthenticated attacker could crash the Apache httpd process by     sending a POST request without a Content-Type header if the     'OIDCPreservePost' directive is enabled, resulting in denial of     service.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.4.12.3-2+deb12u4.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:4597 advisory.

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4155 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4155-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Moritz Schlarb     May 08, 2025                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libapache2-mod-auth-openidc     Version        : 2.4.9.4-0+deb11u6     CVE ID         : CVE-2025-3891     Debian Bug     : 1104484

    A vulnerability has been fixed in mod_auth_openidc, an OpenID Certified     authentication and authorization module for the Apache 2.x HTTP server     that implements the OpenID Connect Relying Party functionality.

    An unauthenticated attacker can crash the Apache httpd process by sending     a POST request without a Content-Type header when OIDCPreservePost is     enabled in mod_auth_openidc. This leads to denial of service.

    A workaround is to disable the OIDCPreservePost directive.

    For Debian 11 bullseye, this problem has been fixed in version     2.4.9.4-0+deb11u6.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-4597 advisory.

    cjose     mod_auth_openidc     [2.4.9.4-8]
    - Resolves: RHEL-87759 - Empty POST causes crash with OIDCPreservePost

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4597 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237084	SUSE SLES12 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:01585-1)	Nessus	SuSE Local Security Checks	high
236933	Alibaba Cloud Linux 3 : 0060: mod_auth_openidc:2.3 (ALINUX3-SA-2025:0060)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235620	Debian dsa-5917 : libapache2-mod-auth-openidc - security update	Nessus	Debian Local Security Checks	medium
235601	AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2025:4597)	Nessus	Alma Linux Local Security Checks	medium
235597	Debian dla-4155 : libapache2-mod-auth-openidc - security update	Nessus	Debian Local Security Checks	medium
235472	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2025-4597)	Nessus	Oracle Linux Local Security Checks	medium
235447	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:4597)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2025-3891

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium