Apache mod_vhost_alias one-byte stack overflow (CVE-2026-109163)
Apache rates the overflow low; the body names 2.4.69 while the title also lists 2.4.70.
32
CVE-2026-109163
Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A stack-based buffer overflow in Apache HTTP Server's mod_vhost_alias overwrites one byte on the stack. It follows CVE-2026-63292 and affects only version 2.4.69. Trigger conditions and the resulting impact are not stated beyond that one-byte overwrite. Servers running 2.4.69 with mod_vhost_alias are affected.
What to do: Apply Apache's update for CVE-2026-109163. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Apache HTTP Server | 2.4.69 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.
- Weakness
- CWE-121