SUSE 2026-3915-1 Important apache2-mod_auth_openidc Out-of

Back Linuxsecurity

SUSE 2026-3915-1 Important apache2-mod_auth_openidc Out-of

Linuxsecurity •LinuxSecurity Advisories • September 2, 2026

Share: View original

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

## This update for apache2-mod_auth_openidc fixes the following issue: * CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc` (bsc#1276217). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-3915=1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3915=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64) * apache2-mod_auth_openidc-debuginfo-2.4.0-7.25.1

## This update for apache2-mod_auth_openidc fixes the following issue: * CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of `mod_auth_openidc` (bsc#1276217). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-3915=1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3915=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64) * apache2-mod_auth_openidc-debuginfo-2.4.0-7.25.1

* CVE-2026-54789 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-54789 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Enterprise High Performance Computing 12 SP5

* SUSE Linux Enterprise Server 12 SP5

* SUSE Linux Enterprise Server 12 SP5 LTSS

* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security

* SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves one vulnerability can now be installed.

*

*

Announcement ID: SUSE-SU-2026:3915-1 Release Date: 2026-09-01T14:57:09Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in apache2-mod_auth_openidc Requires Immediate Patching A critical vulnerability identified as CVE-2026-54789 affects the apache2-mod_auth_openidc module, allowing for out-of-bounds reads and writes in the state-cookie parser. This flaw impacts multiple SUSE Linux distributions, including SUSE Linux Enterprise Server and openSUSE, potentially allowing attackers to exploit the vulnerability to execute arbitrary code. The vulnerability was published on August 21, 2026, and has been assigned a CVSS score of 7.5, indicating a high severity. Patch updates have been released for various versions, including SUSE Linux Enterprise Server 15 SP5, 15 SP6, and openSUSE Leap 15.6. Administrators are urged to apply these patches immediately to mitigate risks. The updates can be installed using the SUSE recommended methods such as YaST or zypper. The vulnerability is currently not reported to be actively exploited in the wild, but its critical nature necessitates prompt action. 5 sources 60

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (2)

Cwe-125 - Out-of-bounds Read Cwe-787 - Out-of-bounds Write

Platforms (1)

SUSE Linux Enterprise Server