CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow
Apache mod_vhost_alias stack overflow may allow code execution via an oversized Host header.
CVE-2026-63292 is a moderate-severity stack-based buffer overflow in mod_vhost_alias affecting Apache HTTP Server 2.4.0 through 2.4.68 on all platforms. A remote client can cause denial of service or potentially execute arbitrary code by sending a Host header longer than 8192 bytes when VirtualDocumentRoot uses a hostname format specifier. Exploitation in the wild is not reported.
- Stack overflow in mod_vhost_alias through 2.4.68
- Needs VirtualDocumentRoot hostname format specifier
- Host header over 8192 bytes may cause DoS or code execution
- Vendor severity is moderate
Vulnerabilities mentionedAll →
- CVE-2026-632927.5<1%Stack buffer overflow in Apache HTTP Server mod_vhost_aliaspublished · Apache Software Foundation Apache HTTP Server PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63292 | Stack buffer overflow in Apache HTTP Server mod_vhost_alias |
Posted by Eric Covener on Oct 01 Severity: moderate Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and...
This source does not provide full text. Read it at seclists.org.