openEuler-SA-2026-3009

Synopsis:

mod_auth_openidc security updateSummary:

An update for mod_auth_openidc is now available for openEuler-22.03-LTS-SP4Description:

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).

Security Fix(es):

An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. oidc_state_cookies_parse_token() (src/state.c) scans a cookie token for the = that separates the cookie name from its value with a loop whose only real termination condition is finding a = byte — it does not stop at the string terminator. The cookie != NULL test can never become false, because cookie is only ever incremented (never reassigned to NULL). A request whose Cookie header contains a token that begins with the configured state-cookie prefix (default mod_auth_openidc_state_) but contains no = makes the loop walk past the end of the token buffer, reading adjacent process memory until it happens to encounter a = (0x3D) byte, and then writing a NUL byte at that out-of-bounds location. This parser runs early on requests that begin a new authentication flow and on requests to the OIDCRedirectURI callback — before any session or state validation — so the condition is reachable by an unauthenticated, remote client that fully controls the Cookie header.(CVE-2026-54789)Topic:

An update for mod_auth_openidc is now available for openEuler-22.03-LTS-SP4.

openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.Severity:

HighAffected Component:

mod_auth_openidc