CVE-2025-3891
Redhat Enterprise Linux 7.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-3891 is a high-severity Uncaught Exception (CWE-248) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 30% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2025-3891 affects the mod_auth_openidc module for Apache httpd. It stems from improper handling of an empty POST request when the OIDCPreservePost directive is enabled, causing the server to crash consistently and resulting in a denial of service that impacts availability. The issue carries a CVSS 3.1 base score of 7.5 and is associated with CWE-248.
A remote unauthenticated attacker can exploit the flaw over the network by sending a specially crafted empty POST request to a vulnerable server with the directive enabled, achieving disruption of service without any authentication or user interaction required.
Red Hat has published multiple advisories (RHSA-2025:10002 through RHSA-2025:10007) that address the issue through updated packages for affected products.
The associated EPSS score remains low, with a current value of 0.0101 and a peak of 0.0133.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13653
Vulnerability Data
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently,…
more
affecting availability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Security engineering principles include robust exception management to keep the system in a defined state.
Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.
Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect uncaught exceptions before production deployment.
Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.
Application security requirements typically mandate robust error and exception handling.
Secure architecture principles call for centralized, comprehensive exception management.
Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.