CVE-2026-109163 — Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Description

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)

This issue affects Apache HTTP Server: 2.4.69.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	2.4.69 – ≤ 2.4.70	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	No fix yet	—
Debian 13	apache2	2.4.71-1~deb13u1	—
Debian 12	apache2	2.4.71-1~deb12u1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	apache2	2.4.68-1ubuntu6.2	USN-9090-1
Ubuntu 26.04 LTS	apache2	2.4.66-2ubuntu2.8	USN-9090-1
Ubuntu 24.04 LTS	apache2	2.4.58-1ubuntu8.19	USN-9090-1
Ubuntu 22.04 LTS	apache2	2.4.52-1ubuntu4.27	USN-9090-1

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	apache2	2.4.41-4ubuntu3.23+esm11	USN-9090-1
Ubuntu Pro 18.04 LTS	apache2	2.4.29-1ubuntu4.27+esm15	USN-9090-1
Ubuntu Pro 16.04 LTS	apache2	2.4.18-2ubuntu3.17+esm24	USN-9090-1
Ubuntu Pro 14.04 LTS	apache2	2.4.7-1ubuntu4.22+esm19	USN-9090-1

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	apache2 +6	2.4.71-150700.4.30.1	SUSE-SU-2026:5231-1
SLES 15 SP6	apache2 +5	2.4.66-150600.5.61.1	SUSE-SU-2026:5235-1
SLES 15 SP5	apache2	2.4.66-150400.6.63.1	SUSE-SU-2026:5234-1
SLES 15 SP4	apache2	2.4.66-150400.6.63.1	SUSE-SU-2026:5234-1
SLES 12 SP5	apache2 +1	2.4.66-35.87.1	SUSE-SU-2026:5236-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP6	apache2 +5	2.4.66-150600.5.61.1	SUSE-SU-2026:5235-1
SLES for SAP 15 SP5	apache2	2.4.66-150400.6.63.1	SUSE-SU-2026:5234-1
SLES for SAP 15 SP4	apache2	2.4.66-150400.6.63.1	SUSE-SU-2026:5234-1
SLE HPC 15 SP5	apache2	2.4.66-150400.6.63.1	SUSE-SU-2026:5234-1
SLE HPC 15 SP4	apache2	2.4.66-150400.6.63.1	SUSE-SU-2026:5234-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2	2.4.71-1.1	openSUSE-SU-2026:12537-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.71-r0	—
Alpine v3.23	apache2	2.4.71-r0	—
Alpine v3.22	apache2	2.4.71-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	httpd +8	2.4.71-1.amzn2023.0.1	ALAS2023-2026-3458
Amazon Linux 2023	mod_ssl +2	1:2.4.71-1.amzn2023.0.1	ALAS2023-2026-3458
Amazon Linux 2	httpd +7	2.4.71-1.amzn2.0.1	ALAS2-2026-4114
Amazon Linux 2	mod_ssl +2	1:2.4.71-1.amzn2.0.1	ALAS2-2026-4114

Advisories 9

openSUSE-SU-2026:12537-1 apache2-2.4.71-1.1 on GA media SUSE / openSUSE Security Updates · Nov 14, 2026
SUSE-SU-2026:5236-1 Security update for apache2 SUSE / openSUSE Security Updates · Nov 14, 2026
SUSE-SU-2026:5231-1 Security update for apache2 SUSE / openSUSE Security Updates · Nov 14, 2026
SUSE-SU-2026:5234-1 Security update for apache2 SUSE / openSUSE Security Updates · Nov 14, 2026
SUSE-SU-2026:5235-1 Security update for apache2 SUSE / openSUSE Security Updates · Nov 14, 2026
USN-9090-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
WID-SEC-2026-4517 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
ALAS2023-2026-3458 Critical: httpd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
ALAS2-2026-4114 Critical: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 12, 2026

References

https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory