HIGH Published April 29, 2025

CVE-2025-3891

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

CVSS base score
7.5 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-248
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

apache http server redhat enterprise linux debian debian linux

References

View full NVD advisory →

More apache vulnerabilities

Published the same day

Related reading

← Back to CVE watch