Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote…
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache HTTP Server
- CVSS
- 7.5
- EPSS
- 0.009 (p61)
- Fix
- available
- Exposure class
- Web platform
Why it ranks 26 (Notable)
- CVSS 7.5 high
- Product class: web platform
- Covered by 2 independent sources
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-63292 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.