Description

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T16:17:19.000Z",
  "pubdate": "2026-08-21T16:17:19.000Z",
  "executiveSummary": "An out-of-bounds read and a one-byte out-of-bounds write vulnerability exists within the state-cookie parser of mod_auth_openidc prior to version 2.4.19.4. This vulnerability impacts the Apache 2.x HTTP server implementing OpenID Connect Relying Party functionality.\nThe flaw allows potential memory disclosure or memory corruption via malformed state cookies, specifically value-less tokens lacking an equal sign. Attackers can trigger this condition by supplying specially crafted Cookie headers to the vulnerable server.\nThe risk implications include potential denial of service or destabilization of the Apache worker process due to memory corruption. Exploitation relies on interacting with the web server via standard network exposures where mod_auth_openidc processes incoming HTTP requests.\nNo in-product workarounds are available, making patching the primary mechanism to eliminate exposure. Stop-gap measures require upstream reverse proxies or WAFs to mitigate the threat until systems are updated.",
  "technicalDetails": "The root cause of the vulnerability resides in the state-cookie parser implementation within mod_auth_openidc. Prior to version 2.4.19.4, the parsing logic fails to properly validate the structure of state tokens when scanning Cookie headers, specifically lacking a strict check for the string terminator.\nWhen a value-less token is supplied within the Cookie header (such as a token missing the assignment operator '='), the parser continues scanning past the expected boundaries. This improper boundary check leads directly to an out-of-bounds read and a one-byte out-of-bounds write condition.\nThe vulnerable component is the state-cookie parser handling authentication session states in mod_auth_openidc versions prior to 2.4.19.4 running on Apache 2.x HTTP servers. Network exposure is inherent to any deployment accepting external HTTP requests requiring OpenID Connect authentication.\nAuthentication and privilege requirements for exploitation are minimal to none, as unauthenticated attackers can typically dispatch crafted HTTP requests containing malicious Cookie headers directly to endpoints protected by the module.\nThe attack flow proceeds as follows: First, an attacker crafts an HTTP request containing a malformed state cookie lacking a value or an equal sign. Second, the Apache HTTP server routes the request to the mod_auth_openidc module. Third, the state-cookie parser attempts to parse the malformed token and fails to stop scanning at the string terminator. Finally, the parser reads and writes past the allocated memory buffer, triggering an out-of-bounds memory operation that can result in application crashes or undefined behavior.\nThe vulnerability is resolved in version 2.4.19.4 by enforcing strict scan termination at the string terminator, ensuring that value-less tokens are safely rejected rather than parsed out-of-bounds."
}