AI analysis
A stack-based buffer overflow (CWE-121) in mod_vhost_alias affects Apache HTTP Server through 2.4.68 on all platforms. A remote client can trigger it with an HTTP request whose Host header exceeds 8192 bytes, but only when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize has been raised above the default. Impact is denial of service, with potential arbitrary code execution. Operators of Apache httpd in that mass-virtual-hosting configuration are affected; default field-size limits are not described as vulnerable. There is no known public proof of concept, the issue is not listed in CISA KEV, and CVSS is not yet scored.
What to do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, keep LimitRequestFieldSize at the default (8192) and avoid hostname format specifiers in VirtualDocumentRoot, or disable mod_vhost_alias if dynamic mass vhosting is not required. Review configs for VirtualDocumentRoot interpolations combined with a raised field-size limit.
Affected
| Apache Software Foundation Apache HTTP Server | through 2.4.68 (fixed in 2.4.69), all platforms |
Estimated exposure
large≈10,000–100,000 servers plausibly in the vulnerable configuration (not all Apache installs) — Apache HTTP Server is one of the most widely deployed web servers (tens of millions of sites in public surveys), but this bug only applies when mod_vhost_alias VirtualDocumentRoot uses a hostname specifier and LimitRequestFieldSize is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.