CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

The Brief

CVE-2026-109163 is a stack-based buffer overflow in Apache HTTP Server's mod_vhost_alias module, described as a 1-byte stack buffer overwrite.
The issue affects Apache HTTP Server 2.4.69 through 2.4.70, according to the oss-sec post.
The disclosure is listed as low severity and follows CVE-2026-63292, a related mod_vhost_alias issue.

Why it matters

Servers running affected Apache HTTP Server versions with mod_vhost_alias enabled may be exposed to a memory corruption bug, so operators should check whether the module is in use.

Who’s affected

Teams running Apache HTTP Server 2.4.69 or 2.4.70
Operators using mod_vhost_alias for virtual hosting

What to do

Check whether Apache HTTP Server 2.4.69 or 2.4.70 is deployed and whether mod_vhost_alias is loaded

Apache HTTP Server 2.4.69
Apache HTTP Server 2.4.70
CVE-2026-109163
#apache
#security
#vulnerability
#http-server
#mod_vhost_alias
#memory-safety

Posted by Eric Covener on Nov 11 Severity: low Affected versions: - Apache HTTP Server 2.4.69 through 2.4.70 Description: Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69…

Read the full story at seclists.org ↗

Timeline

Nov 11
Vulnerability disclosed on oss-sec by Eric Covener
Nov 11 · 4:37 PM
Open Source Security
CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)