Hyojae Lee

A stack-based buffer overflow exists in the `mod vhost alias` module. A remote client can trigger a denial of service or potentially execute arbitrary code by sending an HTTP request with a `Host` header exceeding 8192 bytes. This occurs when `VirtualDocumentRoot` uses a hostname format specifier and the `LimitRequestFieldSize` directive is increased above its default value.

An authentication bypass exists in the `mod auth digest` module. A man-in-the-middle (MITM) attacker can replay captured digest authentication credentials using crafted requests. This occurs when the `AuthDigestNonceLifetime` variable is set to 0, which can trigger garbage collection of the client's shared memory entry.