PT-2024-2685 · Unknown+6 · Mod Auth Openidc+6
Zandbelt
·
Published
2024-02-07
·
Updated
2025-12-29
·
CVE-2024-24814
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
mod auth openidc versions prior to 2.4.15.2
Description
The issue is related to a denial of service (DoS) attack due to missing input validation on the
mod auth openidc session chunks cookie value. This allows an attacker to craft requests that can make the server unresponsive or crash with minimal effort. By manipulating the mod auth openidc session chunks cookie value to a very large integer, the server struggles with the request and finally returns a 500 error. Making a few such requests can cause the server to become unresponsive.Recommendations
For versions prior to 2.4.15.2, upgrade to version 2.4.15.2 to address the issue. As a temporary workaround, consider restricting access to the
mod auth openidc session chunks cookie to minimize the risk of exploitation. Avoid using large integer values for the mod auth openidc session chunks cookie until the issue is resolved.Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Red Os
Rocky Linux
Suse
Mod Auth Openidc