Apache HTTP Server EUVD-2026-90902

Exploitation requires a specific non-default Apache configuration: mod_vhost_alias must be in use with VirtualDocumentRoot (or VirtualScriptAlias) configured using a hostname format specifier (e.g. %0/%1), AND LimitRequestFieldSize must be raised above its default value of 8192 bytes so that a Host header exceeding 8192 bytes is accepted rather than rejected. Against default configurations the oversized Host header is dropped by the default LimitRequestFieldSize, so exploitation is NOT possible out-of-the-box. No authentication is required (a remote client can send the request), but the hard limiting factor is this operator-set configuration, which is uncommon and dramatically narrows the realistically exploitable population. Affected versions are Apache HTTP Server through 2.4.68 on all platforms; 2.4.69 fixes it.

No CVSS vector, EPSS, KEV, or POC data is provided, so quantitative exploitation signals are entirely absent - this is the dominant uncertainty here. Exploitation status: no public exploit identified at time of analysis, and there is no evidence of active exploitation. The headline product (Apache HTTP Server) is ubiquitous, which would normally elevate priority, but the vulnerability is gated behind a non-default configuration: VirtualDocumentRoot must use a hostname format specifier AND LimitRequestFieldSize must be raised above its 8192-byte default. Both conditions are operator-controlled and uncommon in typical deployments, which sharply narrows the real-world exposed population despite the huge install base. The impact is a confirmed denial of service with only 'potential' arbitrary code execution per the vendor description - stack-based overflow RCE on modern Apache builds is non-trivial due to stack protections, so the RCE outcome is unconfirmed and should not be treated as established. Net: this is a credible but conditional issue - worth patching promptly on affected 2.4.x servers, but it is not a drop-everything mass-exploitation event absent evidence of in-the-wild use or a working exploit. Verify your own httpd.conf for the specific VirtualDocumentRoot/LimitRequestFieldSize combination to determine whether you are actually exposed.

An attacker identifies an Apache HTTP Server (≤2.4.68) whose administrator has enabled VirtualDocumentRoot with a hostname format specifier and raised LimitRequestFieldSize above the default 8192 bytes. The attacker sends a crafted HTTP request with a Host header exceeding 8192 bytes, overflowing a stack buffer in mod_vhost_alias to crash the worker (denial of service) and potentially achieve code execution. No public exploit is identified at time of analysis.