Description

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-01T17:17:29.803Z",
  "pubdate": "2026-10-01T17:17:29.803Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the mod_vhost_alias module of the Apache HTTP Server, affecting versions up to 2.4.68.\nThe flaw occurs when the server is configured to use hostname format specifiers within the VirtualDocumentRoot directive.\nIf an administrator increases the LimitRequestFieldSize directive beyond the default 8192 bytes, the system becomes susceptible to memory corruption.\nA remote, unauthenticated attacker can exploit this by crafting an HTTP request with an excessively large Host header, potentially leading to a denial of service (DoS) state via process crash or, in more sophisticated scenarios, the execution of arbitrary code with the privileges of the Apache child process.\nThis vulnerability is particularly dangerous in environments where high request field limits are required for legitimate business operations, as it lowers the threshold for successful memory exploitation.\nGiven the ubiquitous nature of Apache HTTP Server, this poses a significant risk to web infrastructure, necessitating prompt patching to version 2.4.69.",
  "technicalDetails": "The vulnerability resides in the internal handling of hostname format specifiers within the mod_vhost_alias module. When mod_vhost_alias is active and configured to dynamically map requests to document roots based on the Host header, the module performs string processing and interpolation to resolve the filesystem path.\nThe root cause is an inadequate bounds check when copying the manipulated Host header data into a stack-allocated buffer. Under default conditions, Apache enforces a LimitRequestFieldSize of 8192 bytes, which serves as a protective ceiling for header processing. However, when this limit is manually increased by the system administrator to accommodate larger request headers, the underlying buffer in mod_vhost_alias is insufficient to hold the expanded input.\nThe attack flow begins when an attacker sends an HTTP request featuring a malicious Host header exceeding the intended 8192-byte stack buffer capacity. Because the application logic fails to perform sufficient length validation during the interpolation of the hostname specifier, the input data spills over the buffer's defined boundaries.\nThis stack-based overflow allows for the corruption of adjacent memory addresses, including sensitive control data such as the saved instruction pointer (EIP/RIP) or saved frame pointers. By precisely crafting the overflow payload, an attacker can overwrite these pointers to redirect the program execution flow to malicious shellcode or execute Return-Oriented Programming (ROP) chains.\nIf the payload is malformed or intentionally randomized, the immediate impact is an exception that triggers an immediate crash of the Apache worker process, resulting in a denial of service. If the payload is carefully engineered, it facilitates arbitrary code execution. This exploitation does not require prior authentication and can be initiated over a standard network connection via HTTP protocols.\nThe vulnerability is pervasive across all platforms where Apache 2.4.68 or older is deployed with the affected module configuration. The exploitation succeeds specifically because the module assumes that the size of the processed hostname will remain within a predictable, lower threshold, failing to account for the dynamic expansion of LimitRequestFieldSize.\nPost-exploitation impact includes full compromise of the web server process, potentially allowing the attacker to read, modify, or delete sensitive files on the server, intercept credentials, or pivot into the internal network infrastructure."
}