CVE-2026-63292
Apache HTTP Server: mod_vhost_alias stack overflow
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
| CWE | CWE-121 |
| Vendor | apache software foundation |
| Product | apache http server |
| Published | Oct 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache http server
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache http server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache HTTP Server
2.4.0 ≤ 2.4.68
References
Credits
Hyojae Lee Zhen Kong