PT-2025-18145 · Apache+8 · Apache Http Server+8

Published 2024-07-29 · Updated 2025-12-29 · CVE-2025-3891

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache httpd mod auth openidc module (affected versions not specified)

Description A flaw in the mod auth openidc module for Apache httpd allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled, causing the server to crash consistently and affecting availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-248

Related Identifiers

ALSA-2025:4597

ALSA-2025:9396

ALT-PU-2023-8441

BDU:2025-10948

BIT-APACHE-2025-3891

CESA-2025_4597

CVE-2025-3891

DLA-4155-1

DSA-5917-1

GHSA-X7CF-8WGV-5J86

INFSA-2025_4597

INFSA-2025_9396

RHSA-2025:10002

RHSA-2025:10003

RHSA-2025:10004

RHSA-2025:10006

RHSA-2025:10007

RHSA-2025:10008

RHSA-2025:10010

RHSA-2025:4597

RHSA-2025:9396

RHSA-2025_4597

RHSA-2025_9396

SUSE-SU-2025:01585-1

SUSE-SU-2025:01953-1

SUSE-SU-2025:01962-1

SUSE-SU-2025:4532-1

SUSE-SU-2025_01585-1

SUSE-SU-2025_01953-1

SUSE-SU-2025_01962-1

Affected Products

Alt Linux

Almalinux

Apache Http Server

Centos

Debian

Red Hat

Red Os

Rocky Linux

Suse

References · 74

• https://access.redhat.com/errata/RHSA-2025:10006 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-4597.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:9396 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:4597 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-3891 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-3891 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:10007 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:10002 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01953-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-9396.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3891 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3891 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4155-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10948 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-3891 · Vendor Advisory