CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Published Nov 11, 2026
·Updated
modvhostalias 1 byte stack buffer overwrite (after CVE-2026-63292)
Other sources
Stack-based buffer overflow vulnerability in Apache HTTP Server's modvhostalias (after CVE-2026-63292)
This issue affects Apache HTTP Server: 2.4.69.
— MITRE
Affected Software
4 affected components
debian/apache2*
debian/apache2*
debian/apache2*
debian/apache2<=2.4.68-1~deb12u1, <=2.4.67-1~deb12u3, <=2.4.68-1~deb13u1, <=2.4.69-1~deb13u1, <=2.4.69-1, <=2.4.70-1
Event History
Nov 11, 2026
CVE Published
via OSV·02:47 PM
Data Sourced
via OSV·02:47 PM
DescriptionAffected Software
CVE Published
via MITRE·02:55 PM
Data Sourced
via MITRE·02:55 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionWeakness