{
  "from_raw": "Eric Covener <covener@apache.org>",
  "from": "Eric Covener <co...@apache.org>",
  "gravatar": "ee9bd44fca004cd144fce0d972679406",
  "to": "an...@apache.org,\n de...@httpd.apache.org",
  "subject": "CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow",
  "message-id": "<3ace339b-0c11-97ed-d8e6-8017232f6feb@apache.org>",
  "mid": "483gtdzpsf4yz4v0tyb64703pt9kllh8",
  "permalinks": [
    "483gtdzpsf4yz4v0tyb64703pt9kllh8",
    "r43734e3dfcc40755cce058d26a5d7c507d0e221e3c5a920aac02b942@<announce.apache.org>"
  ],
  "dbid": "3d0871036e1fda98fab9cb80e5e718b8fbcd3f56059219e5bbd574efa0b97a8e",
  "cc": "de...@httpd.apache.org",
  "epoch": 1790878110,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/10/01 18:08:30",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: moderate \n\nAffected versions:\n\n- Apache HTTP Server 2.4.0 through 2.4.68\n\nDescription:\n\nStack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.\n\nCredit:\n\nHyojae Lee (finder)\nZhen Kong (finder)\n\nReferences:\n\nhttps://httpd.apache.org/security/vulnerabilities_24.html\nhttps://httpd.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-63292\n\nTimeline:\n\n2026-06-17: Report received\n2026-10-01: fixed in 2.4.x by r1938676\n2026-10-01: 2.4.69 released\n\n",
  "body_short": "Severity: moderate \n\nAffected versions:\n\n- Apache HTTP Server 2.4.0 through 2.4.68\n\nDescription:\n\nStack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 3469,
  "id": "483gtdzpsf4yz4v0tyb64703pt9kllh8"
}