CVE-2026-63292

Think of this like a mail slot designed for a certain size of envelope — if someone stuffs an oversized package through it, it can jam or even break the lock on the door behind it. Here, a web server component that handles multiple websites on one machine can be sent an unusually long piece of request data that overflows its internal memory, crashing the server or, in the worst case, letting the attacker run their own commands on it. This only happens if the site owner has specifically configured this hostname-based routing feature and loosened a related size limit.

This matters to you if you run websites on Apache HTTP Server using the mod_vhost_alias module to serve multiple sites based on hostname patterns (VirtualDocumentRoot). It only becomes a risk if that configuration is combined with a manually increased LimitRequestFieldSize setting — standard Apache installs without this specific setup are not exposed.

This is a high-severity, unauthenticated flaw that can crash your server or potentially allow full remote takeover with nothing more than a single oversized web request — no login or user action needed. While no active exploitation or public exploit code has been reported yet, the combination of easy remote triggering and potential code execution means this should be treated as urgent wherever the vulnerable configuration exists. Don't wait for an incident to confirm your exposure and patch.

Audit all Apache HTTP Server instances for mod_vhost_alias being enabled with a VirtualDocumentRoot directive using a hostname format specifier (%0–%4 style patterns), and check if LimitRequestFieldSize has been raised above the compiled-in default (8190 bytes). If both conditions are present, the server is exploitable via a crafted Host header exceeding 8192 bytes, causing a stack-based buffer overflow (CWE-121) that can crash the worker process or potentially achieve code execution. Upgrade to Apache HTTP Server 2.4.69, which contains the fix, following the standard upgrade/restart procedure for your platform; no breaking changes are noted for this specific fix in the vendor advisory. As a temporary mitigation if upgrading is delayed, remove the hostname format specifier from VirtualDocumentRoot or restore LimitRequestFieldSize to its default value to eliminate the vulnerable code path. Not currently in CISA's Known Exploited Vulnerabilities catalog, so there is no mandated remediation deadline, but monitor Apache security advisories and your web server error logs for crash patterns or abnormal worker process restarts following upgrade.

CVSS 7.5 (High), vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-exploitable, low complexity, no privileges or user interaction required, impacting availability (and potentially integrity/confidentiality via RCE, though scored conservatively for availability). Weakness is CWE-121 (stack-based buffer overflow), triggered via an oversized Host header exceeding 8192 bytes when mod_vhost_alias's VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize exceeds default. No public exploit code is on record, no KEV listing, and no dated press confirmation of in-the-wild exploitation. EPSS places predicted exploitation likelihood in the moderate-low range with a flat trend, consistent with a disclosed-but-not-yet-weaponized vulnerability. Fixed in Apache HTTP Server 2.4.69.