7.5

CVE-2024-24814: debian debian_linux Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighModified
AliasesMGASA-2024-0081SUSE-SU-2024:0757-1SUSE-SU-2024:0758-1
Published 13-02-2024Last modified 10-04-2025
Open JSON

Vulnerability summary

CVE-2024-24814 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 68.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
SUSE-SU-2025:4532-1

Timeline

  1. 13-02-2024
    PublishedVulnerability first disclosed.
  2. 10-04-2025
    Last modifiedVulnerability information updated.

Description

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.25%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

0.00 pp

From 1.25% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Mod Auth Openidc

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Suse17 products
  • apache2-mod_auth_openidc&distro=SUSE Enterprise Storage 7.1< 2.3.8-150100.3.28.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.3.8-150100.3.28.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 2.3.8-150100.3.28.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.3.8-150100.3.28.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.3.8-150100.3.28.1
Redhat7 products
  • cjose< 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • cjose-debuginfo< 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • cjose-debugsource< 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • cjose-devel< 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • mod_auth_openidc< 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 | < 0:2.4.10-1.el9
Opensuse3 products
  • apache2-mod_auth_openidc&distro=openSUSE Leap 15.5< 2.3.8-150100.3.28.1
  • apache2-mod_auth_openidc&distro=openSUSE Leap 15.6< 2.3.8-150600.16.5.1
  • apache2-mod_auth_openidc&distro=openSUSE Tumbleweed< 2.4.15.3-1.1
Debian2 products
  • libapache2-mod-auth-openidc< 2.4.12.3-2+deb12u1 | < 2.4.15.7-1 | < 2.3.10.2-1+deb10u4
  • debian_linuxEOL10.0
Fedoraproject1 product
Mageia1 product
  • apache-mod_auth_openidc< 2.4.13.2-1.1.mga9
Openidc1 product
Ubuntu1 product
  • libapache2-mod-auth-openidcAll versions (No fix recorded)

8 vendors · 33 products

References

26 links
Show all 26 references