CVE Daily

CVE-2025-3891

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allo...

High CVSS 7.5

Overview

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

CWE: CWE-248 Published: 2025-04-29T12:15:32.137
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 7.5 (HIGH)
  • Detected tags: apache, dos, unauth_access (tag impact: HIGH)

Recommended actions:

  • Rate limiting, resource quotas and circuit breakers.
  • Enforce authentication/authorization; reduce default endpoint exposure.

Recommended tools

Tags