CVE-2025-3891

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Uncaught Exception pada apache http server, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Rincian

Terbit di NVD

29 April 2025

Terakhir diubah

29 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2025:4597 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-3891 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/05/msg00007.html mailing list · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:10002
• https://access.redhat.com/errata/RHSA-2025:10003
• https://access.redhat.com/errata/RHSA-2025:10004
• https://access.redhat.com/errata/RHSA-2025:10006
• https://access.redhat.com/errata/RHSA-2025:10007
• https://access.redhat.com/errata/RHSA-2025:10008
• https://access.redhat.com/errata/RHSA-2025:10010
• https://access.redhat.com/errata/RHSA-2025:9396
• https://bugzilla.redhat.com/show_bug.cgi?id=2361633 issue tracking
• https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b
• https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86