CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache HTTP Server deployments through 2.4.68 are affected when mod_vhost_alias uses VirtualDocumentRoot with a hostname format specifier and LimitRequestFieldSize has been raised above its default value. The issue applies on all platforms.
What must an attacker send to trigger the flaw?
A remote client must send an HTTP request with a Host header longer than 8192 bytes. Exploitation can cause denial of service and may potentially allow arbitrary code execution.
Are default Apache configurations affected?
The vulnerable condition requires LimitRequestFieldSize to be raised above its default, in addition to the relevant VirtualDocumentRoot hostname format configuration. The provided information does not indicate that a default configuration meets those conditions.
What should teams do if they cannot upgrade immediately?
Ensure LimitRequestFieldSize is not raised above its default and review whether VirtualDocumentRoot uses a hostname format specifier. Upgrade to Apache HTTP Server 2.4.69 when possible.