CVE-2026-109163: 
Apache HTTP Server Analyse et atténuation de la vulnérabilité

CVE-2026-109163 is a stack-based buffer overflow vulnerability (CWE-121) in the mod_vhost_alias module of Apache HTTP Server, introduced or exposed following the fix for CVE-2026-63292. The vulnerability affects Apache HTTP Server versions 2.4.69 through 2.4.70 and was disclosed on November 11, 2026, via the Apache security mailing list. It carries a CVSS v3.1 base score of 5.9 (Medium), reflecting network-based exploitation with high attack complexity and availability impact only (Apache Advisory, GitHub Advisory, Red Hat Bugzilla).

The root cause is a 1-byte stack buffer overwrite in the mod_vhost_alias module (CWE-121), occurring as a regression after the patch for CVE-2026-63292. An attacker can write one byte beyond the bounds of a stack-allocated buffer by sending a specially crafted HTTP request targeting virtual host alias processing logic, potentially corrupting adjacent stack memory. No authentication is required, but exploitation is rated high complexity due to the precision required to leverage the single-byte overwrite reliably. No public proof-of-concept code has been identified at this time (Apache Advisory, GitHub Advisory).

Successful exploitation of this vulnerability can result in denial of service (server crash) due to stack memory corruption, and in more advanced scenarios may enable privilege escalation or local code execution depending on stack layout and memory protections in place. The CVSS scoring reflects a high availability impact with no direct confidentiality or integrity impact, though the 1-byte overwrite could theoretically be chained with other weaknesses for more severe outcomes. Affected assets are Apache HTTP Server instances running versions 2.4.69–2.4.70 with mod_vhost_alias enabled (Red Hat Bugzilla, Apache Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is reported as 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity required to reliably exploit a single-byte stack overwrite reduces the near-term risk of widespread exploitation (GitHub Advisory, Red Hat Bugzilla).

Apache released a security patch on November 11, 2026; administrators should upgrade Apache HTTP Server to a version beyond 2.4.70 that includes the fix. As an interim workaround, disabling the mod_vhost_alias module is recommended if it is not required for the deployment. Additionally, monitoring for unusual or malformed HTTP requests targeting virtual host configurations can help detect exploitation attempts (Apache Advisory, Red Hat Bugzilla).

Red Hat opened a tracking bug (Bugzilla #2571737) classifying the issue as medium severity and assigned it to their Product Security DevOps Team for triage across affected Red Hat products. Coverage appeared on security aggregation sites including SecurityOnline and LinuxCompatible shortly after disclosure, primarily in the context of the broader Apache HTTP Server 2.4.71 release addressing multiple vulnerabilities. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified (Red Hat Bugzilla).