CVE-2026-109163

CVE-2026-109163 is a stack-based buffer overflow vulnerability in the `mod_vhost_alias` module of the Apache HTTP Server, specifically affecting versions 2.4.69 and 2.4.70. The flaw is triggered when the module parses an overlong, specially crafted `Host` header value in an incoming HTTP request that exceeds 64 bytes. This input causes a one-byte memory overwrite on the stack, which can terminate worker processes and crash the server, resulting in a Denial of Service (DoS). The vulnerability does not lead to remote code execution. The Apache Software Foundation addressed the issue with the release of Apache HTTP Server version 2.4.71 on November 11, 2026. For systems where an immediate upgrade is not feasible, the vulnerability can be mitigated by disabling the `mod_vhost_alias` module, though doing so will disable dynamic mass virtual hosting features that rely on directives like `VirtualDocumentRoot`.