https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:03:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-363307 EUVD-2026-363307 https://cve.radiocsirt.org/vuln/euvd-2026-363307 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54789 <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54789 https://cve.radiocsirt.org/vuln/oesa-2026-3009 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: mod_auth_openidc</p> <p>This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP). Security Fix(es):</p> <p>An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: mod_auth_openidc</p> <p>This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP). Security Fix(es):</p> <p>An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. `oidc_state_cookies_parse_token()` (`src/state.c`) scans a cookie token for the `=` that separates the cookie name from its value with a loop whose only real termination condition is finding a `=` byte — it does not stop at the string terminator. The `cookie != NULL` test can never become false, because `cookie` is only ever incremented (never reassigned to `NULL`). A request whose `Cookie` header contains a token that begins with the configured state-cookie prefix (default `mod_auth_openidc_state_`) but contains no `=` makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a `=` (`0x3D`) byte, and then writing a `NUL` byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the `OIDCRedirectURI` callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the `Cookie` header.(CVE-2026-54789)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3009 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11582-1 <p>apache2-mod_auth_openidc-2.4.20.2-1.1 on GA media</p> <p>apache2-mod_auth_openidc-2.4.20.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11582-1 https://cve.radiocsirt.org/vuln/rhsa-2026:69712 <p>mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing</p> <p>mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing</p> https://cve.radiocsirt.org/vuln/rhsa-2026:69712 https://cve.radiocsirt.org/vuln/suse-su-2026:23593-1 <p>Security update for apache2-mod_auth_openidc</p> <p>Security update for apache2-mod_auth_openidc</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23593-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54789 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libapache2-mod-auth-openidc, Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc, Ubuntu:22.04:LTS: libapache2-mod-auth-openidc, Ubuntu:24.04:LTS: libapache2-mod-auth-openidc, Ubuntu:26.04:LTS: libapache2-mod-auth-openidc</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libapache2-mod-auth-openidc, Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc, Ubuntu:22.04:LTS: libapache2-mod-auth-openidc, Ubuntu:24.04:LTS: libapache2-mod-auth-openidc, Ubuntu:26.04:LTS: libapache2-mod-auth-openidc</p> <p>mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54789 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3492 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3492