Servers and applications

CVE-2026-109163

Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Severity: Low
Published: 11 Nov 2026
Last changed: 11 Nov 2026
Added to UpHeron: 11 Nov 2026
Weakness: Stack-based buffer overflow (CWE-121)
Sources: CVE Program

Description

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)
This issue affects Apache HTTP Server: 2.4.69.

From the CVE Program.

Affected software

Software	Affected versions
Apache HTTP ServerServers and applications · `cna:apache software foundation\|apache http server`	From 2.4.69 up to 2.4.70

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-109163