CVE-2026-63292·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.69 or later to resolve a stack-based buffer overflow in the mod_vhost_alias module. This vulnerability can be triggered when VirtualDocumentRoot uses hostname format specifiers and the LimitRequestFieldSize directive is configured above its default value. Organizations should prioritize this update, particularly if they rely on dynamic virtual host configuration with custom request field size limits.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET|HEAD|OPTIONS|PUT|DELETE HTTP/1\.1.*Host: .{8193,}

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement a WAF rule to reject HTTP requests with Host header values exceeding 8192 bytes. Additionally, if using mod_vhost_alias with format specifiers, restrict requests to known valid hostnames using a whitelist rule before they reach the vulnerable module.

How to check if you are affected

1. Run 'apache2ctl -v' (Ubuntu/Debian) or 'httpd -v' (RHEL/CentOS) to check the installed Apache version. Versions 2.4.0 through 2.4.68 are vulnerable.
2. Check your Apache configuration file (typically /etc/apache2/apache2.conf or /etc/httpd/conf/httpd.conf) for the presence of 'VirtualDocumentRoot' directive with hostname format specifiers (e.g., %s or similar placeholders).
3. Verify the LimitRequestFieldSize setting in your configuration: run 'grep -i LimitRequestFieldSize /etc/apache2/apache2.conf /etc/apache2/conf-enabled/* 2>/dev/null' — if set above 8192, the risk is elevated.
4. Review Apache error and access logs for unusually large Host header values or malformed HTTP requests: 'grep -i 'host.*' /var/log/apache2/access.log | awk '{print length($0), $0}' | sort -rn | head -20'

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2026/10/01/24