A critical vulnerability in the OpenIDC mod_auth_openidc Apache module allows unauthenticated attackers to cause a denial of service via out-of-bounds memory access.

This issue is characterized by out-of-bounds read (CWE-125) and out-of-bounds write (CWE-787) vulnerabilities. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing for potential memory corruption and subsequent service crashes.

The ability for an unauthenticated attacker to trigger a crash in the authentication module presents a high risk to availability. With a CVSS score of 7.5, this vulnerability could be leveraged to perform a denial-of-service attack against web services relying on this module for OpenID authentication.

Immediate Action: Upgrade the mod_auth_openidc module to version 2.4.19.4 or later to resolve the memory safety issues.

Proactive Monitoring: Monitor Apache error logs for signs of segmentation faults or unexpected process terminations associated with the module.

Compensating Controls: Utilize a Web Application Firewall to filter malformed requests that might attempt to trigger memory out-of-bounds conditions in the module.

Public Exploit Available: Unknown

Given the potential for unauthenticated denial-of-service attacks, patching this module is essential for maintaining service stability. Security teams should expedite the update process to ensure the protection of authentication infrastructure.