CVE-2026-54789

A flaw was found in mod_auth_openidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write during state cookie parsing, primarily resulting in a Denial of Service (DoS) for the affected server.

This is an Important denial of service flaw in mod_auth_openidc. The vulnerability arises from an out-of-bounds read and write in the state-cookie parser when processing specially crafted Cookie headers. Exploitation could lead to service unavailability for systems configured with mod_auth_openidc for OpenID Connect Relying Party functionality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Inspect incoming HTTP requests using a Web Application Firewall (WAF), reverse proxy, or Apache’s mod_rewrite module prior to evaluation by mod_auth_openidc. Configure security rules to reject or drop any requests containing malformed Cookie headers—specifically OpenID Connect state cookie tokens that lack an equals sign (=).