-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6504-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 17, 2026 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : libapache2-mod-auth-openidc CVE ID : CVE-2026-54789 It was discovered that incorrect state cookie parsing in mod_auth_openidc, an OpenID Certified authentication and authorisation module for the Apache HTTP server that implements the OpenID Connect Relying Party functionality, could result in denial of service. For the stable distribution (trixie), this problem has been fixed in version 2.4.17-1+deb13u1. We recommend that you upgrade your libapache2-mod-auth-openidc packages. For the detailed security status of libapache2-mod-auth-openidc please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: [email protected] -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmqsLdkACgkQEMKTtsN8 TjbZXQ//f8ZQdv8sKkNvDLxT3VVm0VM5/LWvKTPAIJ+LaRAgQy5PKhfIEOKhQvuF v+V8RZnlUaKJDzvz94zLPFGDPdv9IqfiIjUWbVVWaAn0EVtfUN5JKiqOtjGY/t6J xolvDy6YPq02bFHXAKj68VxVDSm5OhXgGrMfzHj+6k1IUvF51tEFxHk5GS4tO+gc exR5DtRYgvPqBxHxInaugjw2OQQY8ggfQejgAwStKDORiUD4+7/+zPhAvd8SZ8G7 Oxm9UjNjWzn0slZasKs7p/ktrw7k7cA05NLFCB+qoCy8GNFfG5z3qOcwNrxf6CAs pCe6k3m2BmomcfI8ItWuNpKZ3NvwjeNzNoyNoliZ9ynSIHqgMdLEDjwaH7lq0Ds4 TZWiSTOWN66tOwjbbSmaFJn3Ossz9maJ+QOhl+qirzFGNapZ2P3Qxtyn5BKoPhUz tC1wEJEvVTyrqn6QcDvl1hdE07ddHMr2gwPqAXiv0z3RE2t1JD2EgEAYnPPM2SSS UvHvDJzN6IOsU957qjqq4E7HQCOhLUW/XfbJrsZsAnUNyKmISBjW3M6lJMHLnupt w6a9B+fEb76GC8D2uMrzkONwL7PelcrjgtcoV7Lhcuips5bIr+wdnA+gFdPGvVmx pdO/QMbarWZUJbA9+S5iq21FbDAhdYonnCKHke5FeldVTBpMimA= =lWyt -----END PGP SIGNATURE-----
