Vulnerability · high · CVSS 7.5
Apache HTTP Server mod_vhost_alias stack overflow (CVE-2026-109163)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Servers running Apache 2.4.69–2.4.70 with mod_vhost_alias
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
What to do
- Check whether Apache HTTP Server 2.4.69 or 2.4.70 is deployed and whether mod_vhost_alias is loaded
The Brief
- CVE-2026-109163 is a stack-based buffer overflow in Apache HTTP Server's mod_vhost_alias module, described as a 1-byte stack buffer overwrite.
- The issue affects Apache HTTP Server 2.4.69 through 2.4.70, according to the oss-sec post.
- The disclosure is listed as low severity and follows CVE-2026-63292, a related mod_vhost_alias issue.
Why it matters
Servers running affected Apache HTTP Server versions with mod_vhost_alias enabled may be exposed to a memory corruption bug, so operators should check whether the module is in use.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Apache HTTP Server is a web server that ops teams run and maintain. |
| No | Core infrastructure | A single web server module flaw, not foundational software like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Apache HTTP Server is a widely deployed mainstream web server. |
| No | Exploited in the wild | Open Source Security post describes a low-severity overflow; no source reports observed attacks. |
| No | Public exploit | Open Source Security post gives only an advisory; no source mentions published exploit code. |
| Yes | Remote, no login | CVSSCVE-2026-63292: CVSS 7.5 – network, no privileges, no user interaction |
| No | Full takeover | Open Source Security post describes a 1-byte stack overwrite; no source claims code execution or root. |
| No | Secrets exposed | Open Source Security post reports no data theft or exposure. |
| No | Supply chain | Open Source Security post describes a vulnerability, not compromised packages, builds or updates. |
| No | No fix yet | Open Source Security post lists affected versions but does not state that no fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-121
CVE-2026-63292 ↗CVSS 7.5 high AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Apache HTTP Server: mod_vhost_alias stack overflow
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 61% of all CVEs
- Weakness
- CWE-121
Timeline
Vulnerability disclosed on oss-sec by Eric Covener
Open Source Security
CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Source
CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292) ↗ Open Source Security · 1h ago
First seen · 1 source · Full story page · How tiers are decided