sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

High 7.5 Published Updated

An out-of-bounds read and write in the state cookie parser of mod_auth_openidc allows attackers to potentially execute code or cause denial of service.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2026-54789?

CVE-2026-54789 is a high-severity memory corruption vulnerability in mod_auth_openidc, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Weakness: CWE-787, CWE-125

Which versions are affected by CVE-2026-54789?

Linux distribution packages (40)
mod_auth_openidc AlmaLinux:10All versions2.4.16.11-1.el10_2.1
mod_auth_openidc AlmaLinux:9All versions2.4.16.11-1.el9_8.1
mod_auth_openidc Red Hat:enterprise_linux:10.2All versions0:2.4.16.11-1.el10_2.1
mod_auth_openidc-debuginfo Red Hat:enterprise_linux:10.2All versions0:2.4.16.11-1.el10_2.1
mod_auth_openidc-debugsource Red Hat:enterprise_linux:10.2All versions0:2.4.16.11-1.el10_2.1
mod_auth_openidc Red Hat:enterprise_linux:9::appstreamAll versions0:2.4.16.11-1.el9_8.1
mod_auth_openidc-debuginfo Red Hat:enterprise_linux:9::appstreamAll versions0:2.4.16.11-1.el9_8.1
mod_auth_openidc-debugsource Red Hat:enterprise_linux:9::appstreamAll versions0:2.4.16.11-1.el9_8.1
mod_auth_openidc Red Hat:enterprise_linux_eus:10.0All versions0:2.4.15-4.el10_0.2
mod_auth_openidc-debuginfo Red Hat:enterprise_linux_eus:10.0All versions0:2.4.15-4.el10_0.2
mod_auth_openidc-debugsource Red Hat:enterprise_linux_eus:10.0All versions0:2.4.15-4.el10_0.2
cjose Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
cjose-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
cjose-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
cjose-devel Red Hat:rhel_aus:8.4::appstreamAll versions0:0.6.1-3.module+el8.4.0+19462+14bde120
mod_auth_openidc Red Hat:rhel_aus:8.4::appstreamAll versions0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
mod_auth_openidc-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
mod_auth_openidc-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
cjose Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
cjose-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
cjose-debugsource Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
cjose-devel Red Hat:rhel_aus:8.6::appstreamAll versions0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
mod_auth_openidc Red Hat:rhel_aus:8.6::appstreamAll versions0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3
mod_auth_openidc-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3
mod_auth_openidc-debugsource Red Hat:rhel_aus:8.6::appstreamAll versions0:2.4.9.4-1.module+el8.6.0+24867+df0294a5.3
cjose Red Hat:rhel_e4s:8.8::appstreamAll versions0:0.6.1-3.module+el8.8.0+19464+578f4546
cjose-debuginfo Red Hat:rhel_e4s:8.8::appstreamAll versions0:0.6.1-3.module+el8.8.0+19464+578f4546
cjose-debugsource Red Hat:rhel_e4s:8.8::appstreamAll versions0:0.6.1-3.module+el8.8.0+19464+578f4546
cjose-devel Red Hat:rhel_e4s:8.8::appstreamAll versions0:0.6.1-3.module+el8.8.0+19464+578f4546
mod_auth_openidc Red Hat:rhel_e4s:8.8::appstreamAll versions0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3
mod_auth_openidc-debuginfo Red Hat:rhel_e4s:8.8::appstreamAll versions0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3
mod_auth_openidc-debugsource Red Hat:rhel_e4s:8.8::appstreamAll versions0:2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3
mod_auth_openidc Red Hat:rhel_e4s:9.2::appstreamAll versions0:2.4.9.4-1.el9_2.4
mod_auth_openidc-debuginfo Red Hat:rhel_e4s:9.2::appstreamAll versions0:2.4.9.4-1.el9_2.4
mod_auth_openidc-debugsource Red Hat:rhel_e4s:9.2::appstreamAll versions0:2.4.9.4-1.el9_2.4
mod_auth_openidc Red Hat:rhel_e4s:9.4::appstreamAll versions0:2.4.9.4-4.el9_4.3
mod_auth_openidc-debuginfo Red Hat:rhel_e4s:9.4::appstreamAll versions0:2.4.9.4-4.el9_4.3
mod_auth_openidc-debugsource Red Hat:rhel_e4s:9.4::appstreamAll versions0:2.4.9.4-4.el9_4.3
mod_auth_openidc Red Hat:rhel_els:7All versions0:1.8.8-9.el7_9.2
mod_auth_openidc-debuginfo Red Hat:rhel_els:7All versions0:1.8.8-9.el7_9.2

How do I fix CVE-2026-54789?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-54789 being exploited?

There is no known exploitation of CVE-2026-54789 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:75581, ALSA-2026:79177, AZL-96984, CLSA-2026-1791839568, CLSA-2026-1792634626, DEBIAN-CVE-2026-54789 and 25 more.

Is CVE-2026-54789 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free