CVE-2026-63292

A flaw was found in httpd's mod_vhost_alias module. A remote attacker can exploit a stack-based buffer overflow by sending a crafted HTTP request with an excessively large Host header to a server using specific virtual hosting configurations. This issue can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the web server.

Red Hat rates this vulnerability as Important because an unauthenticated remote attacker could cause memory corruption resulting in arbitrary code execution or server crashes under specific virtual host configurations. Exploitation requires non-default settings: the server must have mod_vhost_alias enabled with a hostname format specifier in VirtualDocumentRoot, and LimitRequestFieldSize must be explicitly raised beyond its default threshold of 8192 bytes. Typical Red Hat Enterprise Linux deployments retain the default header limit, which causes the core server to reject oversized Host headers before they reach the virtual host alias handler.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability without code modifications, ensure that LimitRequestFieldSize remains at or below its default limit of 8190 bytes, or disable the mod_vhost_alias module if dynamic virtual hosting is not required.

1. Ensure LimitRequestFieldSize is not configured above 8190 in /etc/httpd/conf/httpd.conf or /etc/httpd/conf.d/:

LimitRequestFieldSize 8190

2. Alternatively, if mod_vhost_alias is not needed, disable it by commenting out its loading directive in /etc/httpd/conf.modules.d/00-base.conf:

# LoadModule vhost_alias_module modules/mod_vhost_alias.so

3. Validate the configuration syntax and reload the service:

apachectl configtest
systemctl reload httpd

Caveats: Restricting LimitRequestFieldSize may reject legitimate requests that carry exceptionally large HTTP headers, returning a 400 Bad Request response. Disabling mod_vhost_alias prevents the use of dynamic virtual host directives such as VirtualDocumentRoot.

Warning: Reloading or restarting the httpd daemon may briefly affect in-flight network connections.