[ALSA-2026:77369] Important: mod_auth_openidc:2.3 security update
Type:
security
Severity:
important
Release date:
2026-10-14
Description:
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789) * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 cjose-0.6.1-5.module_el8.10.0+4297+63ae3533.aarch64.rpm 0383a6da00089ec019d2fe4d2dd99badb6fc89015b96e66946baaba494e05376
aarch64 mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.aarch64.rpm 4a9ad66e2b33de87388b82bfbeff6fe1a081a837f7247a45f4d401e0c4176897
aarch64 cjose-devel-0.6.1-5.module_el8.10.0+4297+63ae3533.aarch64.rpm 5272316f5fb63013457b3d7285fa1c474e27d04e7d1b1e6d94ff4b881e6f560a
ppc64le cjose-0.6.1-5.module_el8.10.0+4297+63ae3533.ppc64le.rpm b3db1076888e9e0650ea466d1735ac24e88aeae68e79b207752ed81bd5f9b91a
ppc64le cjose-devel-0.6.1-5.module_el8.10.0+4297+63ae3533.ppc64le.rpm b526bc003f3fddcbeb7eb876bf272141d0999bb36ac9a46819fa48d20673f769
ppc64le mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.ppc64le.rpm d8838defefdd3acc857c073654aa7d4b6ad369ae8bec62d2097e640a3500b6af
s390x cjose-0.6.1-5.module_el8.10.0+4297+63ae3533.s390x.rpm 1f1fea8249b084060c66a4cefba12c68b7f0aa0923b0a3850291d6ae83b1761e
s390x cjose-devel-0.6.1-5.module_el8.10.0+4297+63ae3533.s390x.rpm 4ee672cdf296c811af75ee0082f2e8d920c5fb5b814e6859df812cbd4324613f
s390x mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.s390x.rpm a90e743b4a90366deb01710f5b8e6114ca82531a62358d135fbb07b48e570d0e
x86_64 cjose-devel-0.6.1-5.module_el8.10.0+4297+63ae3533.x86_64.rpm 8569272423330f1933c6c926adf5ceadfc2c085d6bfaff625b7df012be931c0e
x86_64 mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.x86_64.rpm 8f4eb68e4f3f6575c178e13b26aa6a2471c6da2117468f4f95960a3101926214
x86_64 cjose-0.6.1-5.module_el8.10.0+4297+63ae3533.x86_64.rpm da3f6a082f65e3bb088f8304000415866831415bca1355c1dee421c91cf6463e
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.