Stack-Based Buffer Overflow in Apache HTTP Server's mod_vhost_alias
CVE-2026-109163

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Http Server
Vendor
CVE Published:
11 November 2026

What is CVE-2026-109163?

A stack-based buffer overflow vulnerability exists in the mod_vhost_alias module of the Apache HTTP Server. This vulnerability can be exploited under certain conditions related to the processing of virtual host aliases, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The affected version is Apache HTTP Server 2.4.69. It's crucial for users of this server to review their configurations and apply necessary patches to mitigate the risk.

Affected Version(s)

Apache HTTP Server 2.4.69 <= 2.4.70

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gustavo Aiello
Charles Vosburgh (the-vibe-dev)
Wojciech Tatarski (CloudLinux / TuxCare)
Oz Kaiser (@tatikoma)
Daisuke Hatakeyama (SYZD Research)
.