7.5

CVE-2025-3891: apache http_server Uncaught Exception

CVSS: 7.5v3.1HighModified
AliasesSUSE-SU-2025:01585-1SUSE-SU-2025:01953-1SUSE-SU-2025:01962-1
Published 29-04-2025Last modified 29-06-2026
Open JSON

Vulnerability summary

CVE-2025-3891 is a high (CVSS 7.5) Uncaught Exception vulnerability in apache http_server. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.58%
0%100%
Low · +0.15 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
SUSE-SU-2025:4532-1CGA-W6P6-XXWM-CF9X

Timeline

  1. 29-04-2025
    PublishedVulnerability first disclosed.
  2. 29-06-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.58%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

+0.15 pp

From 1.42% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse18 products
  • apache2-mod_auth_openidc&distro=SUSE Enterprise Storage 7.1< 2.3.8-150100.3.34.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 2.3.8-150100.3.34.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.3.8-150100.3.34.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.3.8-150100.3.34.1
  • apache2-mod_auth_openidc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.3.8-150100.3.34.1
Redhat8 products
  • enterprise_linuxEOL7.0 | 8.0 | 9.0
  • cjose< 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | < 0:0.6.1-3.module+el8.8.0+19464+578f4546 | < 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • cjose-debuginfo< 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | < 0:0.6.1-3.module+el8.8.0+19464+578f4546 | < 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • cjose-debugsource< 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | < 0:0.6.1-3.module+el8.8.0+19464+578f4546 | < 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
  • cjose-devel< 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c | < 0:0.6.1-3.module+el8.4.0+19462+14bde120 | < 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee | < 0:0.6.1-3.module+el8.8.0+19464+578f4546 | < 0:0.6.1-4.module+el8.10.0+21813+b5444eb8
Debian2 products
  • libapache2-mod-auth-openidc< 2.4.14.2-1 | < 2.4.12.3-2+deb12u4 | < 2.4.9.4-0+deb11u6
  • debian_linuxEOL11.0
Apache1 product
Chainguard1 product
  • apache2All versions (No fix recorded)
Opensuse1 product
  • apache2-mod_auth_openidc&distro=openSUSE Leap 15.6< 2.3.8-150600.16.11.1
Ubuntu1 product
  • libapache2-mod-auth-openidcAll versions (No fix recorded)
Wolfi1 product
  • apache2All versions (No fix recorded)

8 vendors · 33 products

References

37 links
Show all 37 references