Critical Vulnerability in apache2-mod_auth_openidc Requires Immediate Patching

A critical vulnerability identified as CVE-2026-54789 affects the apache2-mod_auth_openidc module, allowing for out-of-bounds reads and writes in the state-cookie parser. This flaw impacts multiple SUSE Linux distributions, including SUSE Linux Enterprise Server and openSUSE, potentially allowing attackers to exploit the vulnerability to execute arbitrary code. The vulnerability was published on August 21, 2026, and has been assigned a CVSS score of 7.5, indicating a high severity. Patch updates have been released for various versions, including SUSE Linux Enterprise Server 15 SP5, 15 SP6, and openSUSE Leap 15.6. Administrators are urged to apply these patches immediately to mitigate risks. The updates can be installed using the SUSE recommended methods such as YaST or zypper. The vulnerability is currently not reported to be actively exploited in the wild, but its critical nature necessitates prompt action.

Key Points: • CVE-2026-54789 affects apache2-mod_auth_openidc, allowing out-of-bounds access. • Multiple SUSE and openSUSE versions are impacted, including Server and SAP applications. • Patches are available and should be applied immediately to prevent potential exploitation.