CVE-2024-24814

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-24814
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24814.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-24814
Aliases
  • GHSA-hxr6-w4gc-7vvv
Downstream
Related
Published
2024-02-13T18:46:53Z
Modified
2026-08-12T15:17:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
Details

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24814.json"
}
References

Affected packages

Git / github.com/openidc/mod_auth_openidc

Affected ranges

Type
GIT
Repo
https://github.com/openidc/mod_auth_openidc
Events
Introduced
4fe40bd8bed0c7697f4fb2c3733d02d472cb849e
Fixed
4022c12f314bd89d127d1be008b1a80a08e1203d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.4.15.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.3.11rc1
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.2.0
v2.3.0
v2.3.0rc0
v2.3.0rc3
v2.3.1
v2.3.10
v2.3.10.1
v2.3.10.2
v2.3.11
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0
v2.4.0.1
v2.4.0.2
v2.4.0.3
v2.4.0.4
v2.4.1
v2.4.10
v2.4.11
v2.4.11.1
v2.4.11.2
v2.4.11.3
v2.4.12
v2.4.12.1
v2.4.12.2
v2.4.12.3
v2.4.13
v2.4.13.1
v2.4.13.2
v2.4.14
v2.4.14.1
v2.4.14.2
v2.4.14.3
v2.4.14.4
v2.4.15
v2.4.15.1
v2.4.2
v2.4.2.1
v2.4.3
v2.4.4
v2.4.4.1
v2.4.5
v2.4.6
v2.4.7
v2.4.7.1
v2.4.7.2
v2.4.8.1
v2.4.8.2
v2.4.8.3
v2.4.8.4
v2.4.9
v2.4.9.1
v2.4.9.2
v2.4.9.3
v2.4.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24814.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "322812704310885842820140568782733754296",
            "length": 504
        },
        "id": "CVE-2024-24814-71b5006c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidc/mod_auth_openidc/commit/4022c12f314bd89d127d1be008b1a80a08e1203d",
        "target": {
            "file": "src/util.c",
            "function": "oidc_util_get_chunked_cookie"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "261844483041236310717899455761983491528",
                "105557643451672315148465526064764279959",
                "51777230485431182441958992803497376189",
                "315847452240663979389152691863395937919",
                "311290518095346252640254467490379149150",
                "225055174632963924276835982662294616333",
                "49302270635601701674692179912453249207",
                "158202527401304653540608054441997950290",
                "88584786602322081031641309873993481468",
                "8997013185923299332383544364545207502",
                "186549567489047912340942705100386239270",
                "66809282009186810548405938790455411946",
                "322058496836185590727513664982037560305",
                "15265141313598516542449760163806354324",
                "187612768867496994149503657549485780942",
                "255301382340815817554600480780671525405",
                "172445423416692707799933425584149904831",
                "25143073514638243297474642013239538905",
                "152712783176500459626560029663006655341",
                "314169033207615893373891422947323108816"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-24814-9cb3634e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidc/mod_auth_openidc/commit/4022c12f314bd89d127d1be008b1a80a08e1203d",
        "target": {
            "file": "src/util.c"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:17:03Z"