Security1 hOctober 23, 2026, 05:03

Apache httpd patch fixes mod_vhost_alias stack buffer overflow

Ubuntu's USN-8931-1 advisory of 14 October 2026 covers nine Apache httpd CVEs, led by CVE-2026-63292, a stack-based buffer overflow in mod_vhost_alias rated 7.5. It triggers when a Host header exceeds 8,192 bytes, VirtualDocumentRoot uses a hostname format specifier, and LimitRequestFieldSize is raised above its 8,190-byte default.

DEV Community

Open source

Apache httpd patch fixes mod_vhost_alias stack buffer overflow

CVE-2026-63292 carries a CVSS score of 7.5 (CWE-121)
Trigger requires a Host header longer than 8,192 bytes
LimitRequestFieldSize defaults to 8,190 bytes and must be raised
The advisory also covers CVE-2026-58415, CVE-2026-73636 and CVE-2026-79768

#Apache#Ubuntu

CVE-2026-103552: stack overflow in Apache Directory LDAP API

Security

CVE-2026-91843: Unauthenticated Stack Overflow in Check Point Servers

Security

Apache httpd patch fixes mod_vhost_alias stack buffer overflow

CVE-2026-103552: stack overflow in Apache Directory LDAP API

CVE-2026-91843: Unauthenticated Stack Overflow in Check Point Servers

Apache httpd 2.4.69 fixes 20 flaws, including CVE-2026-63292

Stack Overflow survey: 45% of developers burned out, 17% fear AI replacement