{"id":"DEBIAN-CVE-2026-63292","details":"Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.  Users are recommended to upgrade to version 2.4.69, which fixes this issue.","modified":"2026-10-02T05:00:51.092563262Z","published":"2026-10-01T17:17:29.803Z","upstream":["CVE-2026-63292"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-63292"}],"affected":[{"package":{"name":"apache2","ecosystem":"Debian:12","purl":"pkg:deb/debian/apache2?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1","2.4.59-1~deb10u1","2.4.59-1~deb11u1","2.4.59-1~deb12u1","2.4.59-2","2.4.60-1","2.4.61-1","2.4.61-1~deb11u1","2.4.61-1~deb12u1","2.4.62-1","2.4.62-1~deb11u1","2.4.62-1~deb11u2","2.4.62-1~deb12u1","2.4.62-1~deb12u2","2.4.62-2","2.4.62-3","2.4.62-4","2.4.62-5","2.4.62-6","2.4.63-1","2.4.64-1","2.4.65-1","2.4.65-1~deb11u1","2.4.65-1~deb12u1","2.4.65-2","2.4.65-3","2.4.66-1","2.4.66-1~deb11u1","2.4.66-1~deb12u1","2.4.66-1~deb12u2","2.4.66-1~deb13u1","2.4.66-1~deb13u2","2.4.66-2","2.4.66-3","2.4.66-4","2.4.66-5","2.4.66-6","2.4.66-7","2.4.66-8","2.4.67-1","2.4.67-1~deb11u1","2.4.67-1~deb11u2","2.4.67-1~deb11u3","2.4.67-1~deb12u1","2.4.67-1~deb12u2","2.4.67-1~deb12u3","2.4.67-1~deb13u1","2.4.67-1~deb13u2","2.4.67-1~deb13u3","2.4.67-2","2.4.68-1","2.4.68-1~deb12u1","2.4.68-1~deb13u1","2.4.68-2","2.4.69-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63292.json"}},{"package":{"name":"apache2","ecosystem":"Debian:13","purl":"pkg:deb/debian/apache2?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.65-2","2.4.65-3","2.4.66-1","2.4.66-1~deb11u1","2.4.66-1~deb12u1","2.4.66-1~deb12u2","2.4.66-1~deb13u1","2.4.66-1~deb13u2","2.4.66-2","2.4.66-3","2.4.66-4","2.4.66-5","2.4.66-6","2.4.66-7","2.4.66-8","2.4.67-1","2.4.67-1~deb11u1","2.4.67-1~deb11u2","2.4.67-1~deb11u3","2.4.67-1~deb12u1","2.4.67-1~deb12u2","2.4.67-1~deb12u3","2.4.67-1~deb13u1","2.4.67-1~deb13u2","2.4.67-1~deb13u3","2.4.67-2","2.4.68-1","2.4.68-1~deb12u1","2.4.68-1~deb13u1","2.4.68-2","2.4.69-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63292.json"}},{"package":{"name":"apache2","ecosystem":"Debian:14","purl":"pkg:deb/debian/apache2?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.65-2","2.4.65-3","2.4.66-1","2.4.66-1~deb11u1","2.4.66-1~deb12u1","2.4.66-1~deb12u2","2.4.66-1~deb13u1","2.4.66-1~deb13u2","2.4.66-2","2.4.66-3","2.4.66-4","2.4.66-5","2.4.66-6","2.4.66-7","2.4.66-8","2.4.67-1","2.4.67-1~deb11u1","2.4.67-1~deb11u2","2.4.67-1~deb11u3","2.4.67-1~deb12u1","2.4.67-1~deb12u2","2.4.67-1~deb12u3","2.4.67-1~deb13u1","2.4.67-1~deb13u2","2.4.67-1~deb13u3","2.4.67-2","2.4.68-1","2.4.68-1~deb12u1","2.4.68-1~deb13u1","2.4.68-2","2.4.69-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63292.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}