Apache mod_vhost_alias one-byte stack overflow (CVE-2026-109163)
Original title: CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Apache rates the overflow low; the body names 2.4.69 while the title also lists 2.4.70.
Eric Covener posted a low-severity stack-based buffer overflow in Apache HTTP Server's mod_vhost_alias, described as a one-byte overwrite following CVE-2026-63292. The message body says the issue affects Apache HTTP Server 2.4.69, while the subject says 2.4.69 through 2.4.70. Several researchers are credited. No fixed release or exploitation is stated.
Unconfirmed: The subject and body disagree on whether 2.4.70 is affected.
- Vendor severity is low.
- The overflow is a one-byte stack overwrite in mod_vhost_alias.
- The body says only 2.4.69 is affected.
- The subject line also names 2.4.70.
Impact: One-byte stack buffer overwrite in mod_vhost_alias
| Product | Affected |
|---|---|
| Apache Software Foundation Apache HTTP Server | 2.4.69; subject also says through 2.4.70 |
- CVEs
- CVE-2026-109163
- Vendors
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109163 | Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69 | — | — |
From the original article
Posted by Eric Covener on Nov 11 Severity: low Affected versions: - Apache HTTP Server 2. 4. 69 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.