CVE-2026-109163

{
  "etk_id": "ETK-2026-4185",
  "cve_id": "CVE-2026-109163",
  "display_id": "CVE-2026-109163",
  "ghsa_id": "GHSA-xxrj-387x-fr5v",
  "euvd_id": "EUVD-2026-123533",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stack buffer overflow in Apache HTTP Server mod_vhost_alias",
  "summary": "Apache HTTP Server 2.4.69 is affected by a stack-based buffer overflow in its mod_vhost_alias module. An attacker may be able to trigger the overflow when the affected module is in use, but the available advisory material does not specify the required conditions or resulting impact.",
  "mitigation": "Disable mod_vhost_alias on affected servers where it is not required. Where it must remain enabled, reduce exposure by limiting access to the service until Apache publishes and you can deploy a confirmed corrected release.",
  "vendor": "Apache Software Foundation",
  "product": "Apache HTTP Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.4.69, <= 2.4.70"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache HTTP Server",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.4191114,
  "t0_at": "2026-11-11T14:55:08.116000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T14:55:08.116000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T14:55:08.116000+00:00",
      "url": "https://github.com/advisories/GHSA-xxrj-387x-fr5v"
    }
  }
}