CVE-2026-63292

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69

Description A stack-based buffer overflow exists in the mod vhost alias module. A remote client can trigger a denial of service or potentially execute arbitrary code by sending an HTTP request with a Host header exceeding 8192 bytes. This occurs when VirtualDocumentRoot uses a hostname format specifier and the LimitRequestFieldSize directive is increased above its default value.

Recommendations Upgrade to version 2.4.69.