onyx --cves cve-2025-3891
CVE-2025-3891
- score
- <0.1
- cvss
- 7.5
- epss
- 1.6%
- published
- 2025-04-29
- kev added
- —
- first seen
mod_auth_openidc for Apache httpd contains a denial of service caused by handling empty POST requests when OIDCPreservePost is enabled, letting remote unauthenticated attackers crash the server, exploit requires sending an empty POST request.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
CWE-248
NVD-CWE-noinfo
References 14
- https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b
- https://bugzilla.redhat.com/show_bug.cgi?id=2361633
- https://lists.debian.org/debian-lts-announce/2025/05/msg00007.html
- https://access.redhat.com/errata/RHSA-2025:9396
- https://access.redhat.com/errata/RHSA-2025:10003
- https://access.redhat.com/errata/RHSA-2025:10006
- https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86
- https://access.redhat.com/errata/RHSA-2025:4597
- https://access.redhat.com/security/cve/CVE-2025-3891
- https://access.redhat.com/errata/RHSA-2025:10002
- https://access.redhat.com/errata/RHSA-2025:10004
- https://access.redhat.com/errata/RHSA-2025:10007
- https://access.redhat.com/errata/RHSA-2025:10008
- https://access.redhat.com/errata/RHSA-2025:10010