mod_auth_openidc implements OpenID Connect Relying Party functionality for Apache 2.x. Prior to version 2.4.19.4 the parser that extracts the state token from incoming Cookie headers lacks bounds checking. The code performs an out‑of‑bounds read and a one‑byte out‑of‑bounds write when it encounters a token without an equals sign. This memory corruption can enable an attacker to craft a malicious Cookie header that results in arbitrary code execution or a denial of service on the server.

Any deployment running OpenIDC mod_auth_openidc before version 2.4.19.4 on an Apache HTTP server is affected. The vulnerability resides in the state‑cookie parsing routine of the module and applies to all supported Apache 2.x releases that include this module.

The CVSS score of 7.5 indicates high severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a specially crafted Cookie header containing a token without an equals sign. This can lead to memory corruption that may allow execution of arbitrary code or a crash of the Apache process. Because the flaw exists in the authentication module, an attacker could potentially bypass authentication or gain full control of the web server if they succeed with an exploit.