mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Affected: openEuler:22.03-LTS-SP4: mod_auth_openidc

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP). Security Fix(es):

An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)

apache2-mod_auth_openidc-2.4.20.2-1.1 on GA media

mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

Security update for apache2-mod_auth_openidc

Affected: Ubuntu:16.04:LTS: libapache2-mod-auth-openidc, Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc, Ubuntu:22.04:LTS: libapache2-mod-auth-openidc, Ubuntu:24.04:LTS: libapache2-mod-auth-openidc, Ubuntu:26.04:LTS: libapache2-mod-auth-openidc

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.