Buffer Overflow in Apache HTTP Server Affects Multiple Platforms
CVE-2026-63292

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Http Server
Vendor
CVE Published:
1 October 2026

What is CVE-2026-63292?

A stack-based buffer overflow vulnerability in the mod_vhost_alias module of the Apache HTTP Server has been identified. This flaw affects versions up to 2.4.68 across all platforms and can be triggered by sending an HTTP request with an excessively large Host header, exceeding 8192 bytes. When coupled with a hostname format specifier in the VirtualDocumentRoot configuration and an increased LimitRequestFieldSize, this vulnerability could allow remote attackers to cause a denial of service or execute arbitrary code. Users are strongly encouraged to upgrade to version 2.4.69 to mitigate this risk.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.68

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hyojae Lee
Zhen Kong
.