Critical Denial of Service Vulnerability in mod_auth_openidc Package
Summary
ALSA-2026:79177: Important: mod_auth_openidc security update. Affects mod_auth_openidc versions < 2.4.16.11-1.el9_8.1. Fixed in 2.4.16.11-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_auth_openidc is an OpenID Connect authentication module designed for the Apache HTTP Server. It allows the server to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server, enabling secure authentication and authorization for web applications. However, it has been found to be vulnerable to a Denial of Service (DoS) attack due to improper parsing of malformed state cookies.
Vulnerability Detail
The vulnerability identified as CVE-2026-54789 allows an attacker to exploit the mod_auth_openidc module by sending specially crafted requests that contain malformed state cookies. This can lead to a Denial of Service condition, causing the server to become unresponsive and potentially disrupt service for legitimate users. The issue arises from the way the module processes state cookies, which can be manipulated to trigger excessive resource consumption.
How To Fix
Minimum fixed version
2.4.16.11-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update mod_auth_openidcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out malformed state cookies before they reach the mod_auth_openidc module. However, this is not a substitute for applying the official patch.
Conclusion
The mod_auth_openidc package has a critical vulnerability that can lead to Denial of Service attacks. It is essential to update to the latest patched version to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for mod_auth_openidc →
FAQ
mod_auth_openidc is an authentication module for the Apache HTTP Server that enables it to act as an OpenID Connect Relying Party and OAuth 2.0 Resource Server.
CVE-2026-54789 refers to a specific vulnerability in the mod_auth_openidc module that allows for Denial of Service attacks through malformed state cookie parsing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is a Denial of Service condition, which can render the server unresponsive and disrupt service for legitimate users.
Yes, the permanent fix is to update the mod_auth_openidc package to version 2.4.16.11-1.el9_8.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for mod_auth_openidc.
