CVE-2025-3891

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

VendorProductVersions
——>= 2.0.0, < 2.4.13.1
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 7—

References

Timeline

Published
Apr 29, 2025
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-38926.7ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be explCVE-2025-38938.6While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provideCVE-2025-38944.8Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the edCVE-2025-38959.1Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. CVE-2025-38975.9The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contCVE-2025-38986.5CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS rCVE-2025-38995.4CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on WeCVE-2025-39006.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site ScriCVE-2025-39016.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows CroCVE-2025-39026.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site SCVE-2025-39037.3Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*.CVE-2025-39047.3Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.
CVE-2025-3891: High severity, CVSS 7.5 | Vulnix