mod_auth_openidc versions before 2.4.19.4 have a vulnerability involving an out-of-bounds read and a one-byte out-of-bounds write in the state-cookie parser component. The issue arises because the parser does not stop scanning at the string terminator, allowing malformed tokens without '=' to be processed incorrectly. This can lead to memory safety violations. The vulnerability is addressed in version 2.4.19.4 by stopping the scan at the string terminator and rejecting value-less tokens. There are no in-product mitigations; however, upstream reverse proxies or web application firewalls that reject or normalize malformed Cookie headers can reduce exposure. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with no known exploits in the wild as of publication.

The vulnerability can cause an out-of-bounds read and a one-byte out-of-bounds write, which may lead to application instability or denial of service. The CVSS score indicates no confidentiality or integrity impact but a high impact on availability. There are no reports of active exploitation in the wild.

Upgrade mod_auth_openidc to version 2.4.19.4 or later, where the vulnerability is fixed. No in-product workarounds are available. As a temporary measure, deploy an upstream reverse proxy or web application firewall that rejects or normalizes malformed Cookie headers containing tokens without '=' to reduce exposure.