CVE-2026-109163Not scored

CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Apache Software Foundation · Apache HTTP Server

No distribution fix yet for Debian 12/13 · Affected: Apache Software Foundation Apache HTTP Server · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

No EPSS score yet. The score appears once FIRST publishes it.

Not scored yet. NVD has not published a CVSS score.

DescriptionNVD

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

Debian 13Affected, no fix releasedchecked 11 Nov 16:00 UTC
Debian 12Affected, no fix releasedchecked 11 Nov 16:00 UTC

What changed

Debian status tracked since 11 Nov 2026.

11 Nov
Debian’s tracker lists Debian 12 as affected, with no fix released Debian
11 Nov
Debian’s tracker lists Debian 13 as affected, with no fix released Debian

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 11 Nov.

11 Nov 16:01
Apache fixes HTTP/2 flaw that could enable remote code execution
SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.