What is the CVSS score of EUVD-2026-64000?

EUVD-2026-64000 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Apache are affected by EUVD-2026-64000?

mod_auth_openidc versions prior to 2.4.19.4 contain an unauthenticated remote denial-of-service vulnerability allowing attackers to crash Apache worker processes via malformed HTTP requests, directly…. A patch is available.

How to fix or mitigate EUVD-2026-64000?

Within 24 hours, complete an inventory of all Apache instances running mod_auth_openidc and identify systems with versions prior to 2.4.19.4, prioritizing authentication-critical infrastructure. Within 7 days, deploy interim mitigations including WAF rules to reject malformed Cookie headers, enable Apache process auto-restart with connection limits to contain crash impact, and implement detailed error logging for exploitation detection. Within 30 days, obtain and test the vendor patch when released and execute phased production upgrades, or finalize comprehensive compensating control deployment if patching is delayed.

Apache EUVD-2026-64000

| CVE-2026-54789 HIGH

Out-of-bounds Read (CWE-125)

2026-08-21 security-advisories@github.com

Information Disclosure Apache Buffer Overflow

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 21, 2026 - 17:16 EUVD

Source Code Evidence Fetched

Aug 21, 2026 - 16:38 vuln.today

Analysis Generated

Aug 21, 2026 - 16:38 vuln.today

CVE Published

Aug 21, 2026 - 16:17 cve.org

HIGH 7.5

DescriptionCVE.org

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed Cookie headers (tokens lacking =) can reduce exposure, but upgrading is the recommended remediation.

Articles & Coverage 1

News 9 New Apache Vulnerabilities - 1 Critical, 8 High Severity Aug 22, 2026

AnalysisAI

Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, complete an inventory of all Apache instances running mod_auth_openidc and identify systems with versions prior to 2.4.19.4, prioritizing authentication-critical infrastructure. …

Threat intelligence, references, and detailed analysis are available after sign-in.