Critical Security Update for mod_auth_openidc and cjose Packages: Denial of Service Vulnerabilities
Summary
ALSA-2026:77369: Important: mod_auth_openidc:2.3 security update. Affects cjose versions < 0.6.1-5.module_el8.10.0+4297+63ae3533. Fixed in 0.6.1-5.module_el8.10.0+4297+63ae3533. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
mod_auth_openidc is an OpenID Connect authentication module for the Apache HTTP Server, enabling it to function as an OpenID Connect Relying Party and OAuth 2.0 Resource Server. The cjose package provides a library for handling JSON Web Tokens (JWT) and cryptographic operations. Both packages are essential for secure authentication and authorization processes in web applications. However, they have been found to contain vulnerabilities that could lead to denial of service attacks.
Vulnerability Detail
The vulnerabilities stem from two main issues: 1) A denial of service vulnerability in mod_auth_openidc caused by malformed state cookie parsing (CVE-2026-54789), which could allow an attacker to disrupt service by sending specially crafted requests. 2) A heap buffer overflow in the cjose library during AES Key Wrap decryption (CVE-2026-53938), which could also lead to denial of service, potentially allowing attackers to exploit memory corruption issues.
How To Fix
Minimum fixed version
0.6.1-5.module_el8.10.0+4297+63ae3533
This is the first release that contains the fix.
sudo dnf update cjoseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing a web application firewall (WAF) to filter out malicious requests targeting these vulnerabilities. Additionally, monitor logs for unusual activity that may indicate attempts to exploit these vulnerabilities.
Conclusion
The vulnerabilities in mod_auth_openidc and cjose pose significant risks to web applications relying on these packages for authentication and authorization. Immediate action is required to update to the patched versions to mitigate the risk of denial of service attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for cjose →
FAQ
mod_auth_openidc is an authentication module for the Apache HTTP Server that allows it to act as an OpenID Connect Relying Party and OAuth 2.0 Resource Server.
The vulnerabilities can lead to denial of service attacks, disrupting the availability of services that rely on the affected packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application's manifest file using the Vulert playground at Vulert Scanner.
Implement a web application firewall (WAF) to filter out malicious requests and monitor your logs for any unusual activity.
For more details, refer to the CVE pages listed in the advisory or consult the official documentation for mod_auth_openidc and cjose.
Related vulnerabilities
Recent vulnerabilities recorded for cjose.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
