CVE-2024-24814

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.15.2

Description The issue is related to a denial of service (DoS) attack due to missing input validation on the mod auth openidc session chunks cookie value. This allows an attacker to craft requests that can make the server unresponsive or crash with minimal effort. By manipulating the mod auth openidc session chunks cookie value to a very large integer, the server struggles with the request and finally returns a 500 error. Making a few such requests can cause the server to become unresponsive.

Recommendations For versions prior to 2.4.15.2, upgrade to version 2.4.15.2 to address the issue. As a temporary workaround, consider restricting access to the mod auth openidc session chunks cookie to minimize the risk of exploitation. Avoid using large integer values for the mod auth openidc session chunks cookie until the issue is resolved.