BIT-apache-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow

Q: Which deployments are exposed?

Apache HTTP Server deployments through 2.4.68 are exposed when mod_vhost_alias uses VirtualDocumentRoot with a hostname format specifier and LimitRequestFieldSize has been raised above its default value.

Q: Does exploitation require authentication or user interaction?

No. A remote client can trigger the issue by sending an HTTP request with a Host header longer than 8192 bytes.

Q: Are default request-header size settings affected?

The issue requires LimitRequestFieldSize to be raised above its default value. Deployments that have not increased this setting do not meet the described exploitation condition.

Q: What can be done before upgrading?

Reduce LimitRequestFieldSize to its default value or otherwise ensure Host headers exceeding 8192 bytes are not accepted. Also review whether VirtualDocumentRoot uses a hostname format specifier; the recommended remediation is upgrading to 2.4.69.

Q: How can administrators identify potentially affected servers?

Check whether the server is running Apache HTTP Server 2.4.68 or earlier, has mod_vhost_alias configured, uses a hostname format specifier in VirtualDocumentRoot, and has increased LimitRequestFieldSize above its default.

Published Oct 1, 2026

Updated

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

1 affected component

Apache HTTP Server<=2.4.68

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·04:11 PM

Data Sourced

via OSV·04:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Apache HTTP Server deployments through 2.4.68 are exposed when mod_vhost_alias uses VirtualDocumentRoot with a hostname format specifier and LimitRequestFieldSize has been raised above its default value.

Does exploitation require authentication or user interaction?

No. A remote client can trigger the issue by sending an HTTP request with a Host header longer than 8192 bytes.

Are default request-header size settings affected?

The issue requires LimitRequestFieldSize to be raised above its default value. Deployments that have not increased this setting do not meet the described exploitation condition.

What can be done before upgrading?

Reduce LimitRequestFieldSize to its default value or otherwise ensure Host headers exceeding 8192 bytes are not accepted. Also review whether VirtualDocumentRoot uses a hostname format specifier; the recommended remediation is upgrading to 2.4.69.

How can administrators identify potentially affected servers?

Check whether the server is running Apache HTTP Server 2.4.68 or earlier, has mod_vhost_alias configured, uses a hostname format specifier in VirtualDocumentRoot, and has increased LimitRequestFieldSize above its default.

BIT-apache-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

Are default request-header size settings affected?

What can be done before upgrading?

How can administrators identify potentially affected servers?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

Are default request-header size settings affected?

What can be done before upgrading?

How can administrators identify potentially affected servers?