Uncaught Exception (CVE-2025-3891)
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
AI Analysis
Technical Summary
The mod_auth_openidc module for Apache HTTP Server, which enables OpenID Connect and OAuth 2.0 functionality, contains a vulnerability (CVE-2025-3891) that allows denial of service via an empty POST request when the OIDCPreservePost feature is enabled. This vulnerability is tracked under CWE-248 and has been rated as having an important security impact by Red Hat Product Security. Red Hat has released updated packages for multiple architectures and variants of Red Hat Enterprise Linux 9 to fix this issue.
Potential Impact
An attacker can exploit this vulnerability to cause a denial of service condition in the Apache HTTP Server using mod_auth_openidc with OIDCPreservePost enabled. This could disrupt authentication services relying on this module, potentially impacting availability of web services.
Mitigation Recommendations
Red Hat has released security updates that fix this vulnerability. Users should apply the updated mod_auth_openidc packages provided for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants. Refer to Red Hat advisory RHSA-2025:9396 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.
Uncaught Exception (CVE-2025-3891)
Description
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mod_auth_openidc module for Apache HTTP Server, which enables OpenID Connect and OAuth 2.0 functionality, contains a vulnerability (CVE-2025-3891) that allows denial of service via an empty POST request when the OIDCPreservePost feature is enabled. This vulnerability is tracked under CWE-248 and has been rated as having an important security impact by Red Hat Product Security. Red Hat has released updated packages for multiple architectures and variants of Red Hat Enterprise Linux 9 to fix this issue.
Potential Impact
An attacker can exploit this vulnerability to cause a denial of service condition in the Apache HTTP Server using mod_auth_openidc with OIDCPreservePost enabled. This could disrupt authentication services relying on this module, potentially impacting availability of web services.
Mitigation Recommendations
Red Hat has released security updates that fix this vulnerability. Users should apply the updated mod_auth_openidc packages provided for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants. Refer to Red Hat advisory RHSA-2025:9396 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:9396
- Cve Count
- 1
Threat ID: 6a4049e027e9c7971983216b
Added to database: 06/27/2026, 22:08:32 UTC
Last enriched: 06/27/2026, 22:27:41 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.