Synopsis
Important: mod_auth_openidc security update
Description
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
* mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected products
Rocky Linux 10 aarch64
Rocky Linux 10 ppc64le
Rocky Linux 10 riscv64
Rocky Linux 10 s390x
Rocky Linux 10 x86_64
Fixes
2521051
CVEs
CVE-2026-54789
Affected packages
Rocky Linux 10 x86_64 - AppStream
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.x86_64.rpm
mod_auth_openidc-debugsource-0:2.4.16.11-1.el10_2.1.x86_64.rpm
mod_auth_openidc-debuginfo-0:2.4.16.11-1.el10_2.1.x86_64.rpm
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.src.rpm
Rocky Linux 10 ppc64le - AppStream
mod_auth_openidc-debugsource-0:2.4.16.11-1.el10_2.1.ppc64le.rpm
mod_auth_openidc-debuginfo-0:2.4.16.11-1.el10_2.1.ppc64le.rpm
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.src.rpm
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.ppc64le.rpm
Rocky Linux 10 s390x - AppStream
mod_auth_openidc-debuginfo-0:2.4.16.11-1.el10_2.1.s390x.rpm
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.s390x.rpm
mod_auth_openidc-debugsource-0:2.4.16.11-1.el10_2.1.s390x.rpm
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.src.rpm
Rocky Linux 10 aarch64 - AppStream
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.aarch64.rpm
mod_auth_openidc-debuginfo-0:2.4.16.11-1.el10_2.1.aarch64.rpm
mod_auth_openidc-debugsource-0:2.4.16.11-1.el10_2.1.aarch64.rpm
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.src.rpm
Rocky Linux 10 riscv64 - AppStream
mod_auth_openidc-0:2.4.16.11-1.el10_2.1.src.rpm