https://seclists.org/oss-sec/2026/q4/23: CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_vhost_alias is used with VirtualDocumentRoot configured with a hostname format specifier and LimitRequestFieldSize is raised above its default value. The issue affects all platforms.
What does an attacker need to exploit the vulnerability?
A remote client needs to send an HTTP request containing a Host header longer than 8192 bytes. Exploitation depends on the affected mod_vhost_alias and VirtualDocumentRoot configuration being present and the request-field-size limit having been increased above default.
Are default Apache HTTP Server configurations affected?
The vulnerability requires LimitRequestFieldSize to be raised above its default value, so deployments retaining the default request field size do not meet the stated exploitation condition. It also requires a VirtualDocumentRoot hostname format specifier.
What can be done before upgrading?
Keep LimitRequestFieldSize at its default value or reduce it so Host headers exceeding 8192 bytes are not accepted, and review whether VirtualDocumentRoot uses a hostname format specifier. Upgrade to Apache HTTP Server 2.4.69 when possible.
How can administrators identify potentially affected servers?
Check whether the server runs Apache HTTP Server 2.4.0 through 2.4.68, has mod_vhost_alias enabled, and uses VirtualDocumentRoot with a hostname format specifier. Also review the effective LimitRequestFieldSize setting to determine whether it has been raised above the default.