CVE-2026-63292
Received Received - Intake

Stack-based Buffer Overflow in Apache HTTP Server mod_vhost_alias

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-63292
EUVD
EUVD-2026-90902

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache_software_foundation apache_http_server 2.4.69

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in mod_vhost_alias in Apache HTTP Server versions up to 2.4.68. It occurs when a remote client sends an HTTP request with a Host header exceeding 8192 bytes. If VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is increased beyond the default, this can cause a denial of service or allow arbitrary code execution.

Detection Guidance

To detect this vulnerability, monitor Apache HTTP Server logs for unusually long Host headers exceeding 8192 bytes. Check if VirtualDocumentRoot uses hostname format specifiers and if LimitRequestFieldSize is set above default. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP requests for malformed Host headers.

Impact Analysis

An attacker could exploit this to crash the Apache server, causing downtime for hosted services. In severe cases, it may allow the attacker to run malicious code on the server, potentially leading to data breaches or further compromise of the system.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution or denial of service, which may result in data breaches or service disruptions. Such incidents could violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data security) if sensitive data is exposed or systems are compromised.

Mitigation Strategies

Immediately upgrade Apache HTTP Server to version 2.4.69 or later. If upgrading is not possible, disable mod_vhost_alias or avoid using VirtualDocumentRoot with hostname format specifiers. Set LimitRequestFieldSize to the default value of 8192 bytes to prevent buffer overflow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart