CVE-2026-63292

Summary

A stack-based buffer overflow in Apache's mod_vhost_alias module allows remote attackers to cause denial of service or potentially execute arbitrary code when processing HTTP requests with oversized Host headers. This occurs specifically when VirtualDocumentRoot uses hostname format specifiers and the LimitRequestFieldSize is increased above default values.

Exploitability

Exploitation appears moderately difficult as it requires a specific configuration involving VirtualDocumentRoot with hostname format specifiers and raised LimitRequestFieldSize, but once configured, remote attackers can trigger the overflow with a single oversized Host header request.

Blast radius

The vulnerability could affect any Apache HTTP Server instance running version 2.4.68 or earlier with the specific mod_vhost_alias configuration, potentially leading to widespread denial of service or code execution across multiple virtual hosts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache HTTP Server 2.4.69 which fixes this buffer overflow vulnerability in mod_vhost_alias.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.