← Vulnerability feed

Vulnerability record · CVE-2023-28625 · published 3 April 2023

CVE-2023-28625: Mod auth openidc null pointer dereference vulnerability

Openidc · Mod Auth Openidc

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

7.5 CVSS 3.1 High EPSS 1.3% · top 30.4% CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References
17 Jun 2026Last modified by NVD

Description

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a Patch
https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 Release Notes
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/WIBKFC22PDH6UXMSZ23PHTD77 Release Notes
https://www.debian.org/security/2023/dsa-5405 Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a Patch
https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 Release Notes
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/WIBKFC22PDH6UXMSZ23PHTD77 Release Notes
https://www.debian.org/security/2023/dsa-5405 Third Party Advisory

Track CVE-2023-28625 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2017-6413Mod auth openidc improper authentication vulnerabilityThe "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip …EPSS 4.3%8.6CVE-2017-6062Mod auth openidc improper authentication vulnerabilityThe "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip …EPSS 3.6%7.5CVE-2024-24814Mod auth openidc uncontrolled resource consumption vulnerabilitymod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Re…EPSS 1.3%7.5CVE-2021-32785Mod auth openidc vulnerabilitymod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenti…EPSS 2.7%7.5CVE-2021-20718Mod auth openidc uncontrolled resource consumption vulnerabilitymod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.EPSS 3.4%7.5CVE-2017-6059Mod auth openidc improper input validation vulnerabilityMod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to…EPSS 5.2%6.1CVE-2022-23527Mod auth openidc open redirect vulnerabilitymod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulne…EPSS 0.91%6.1CVE-2021-39191Mod auth openidc open redirect vulnerabilitymod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenti…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2023-28625), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.