Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CentOS Apache httpd can crash with overly long Host header

published 26 days ago

Summary

The Apache httpd packages for CentOS (httpd, httpd-devel, httpd-manual, httpd-tools, mod_ssl) have a flaw that can be triggered by a very long Host header in a web request. This could cause the server to stop working or be taken over by an attacker. Install the latest security update for these packages as soon as possible to protect your web services.

What to do

Update centos httpd to version 2.2.15-72.el6.tuxcare.els18.
Update centos httpd-devel to version 2.2.15-72.el6.tuxcare.els18.
Update centos httpd-manual to version 2.2.15-72.el6.tuxcare.els18.
Update centos httpd-tools to version 2.2.15-72.el6.tuxcare.els18.
Update centos mod_ssl to version 1:2.2.15-72.el6.tuxcare.els18.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:CentOS:6	centos	httpd	< 2.2.15-72.el6.tuxcare.els18 Fix: upgrade to 2.2.15-72.el6.tuxcare.els18
TuxCare:CentOS:6	centos	httpd-devel	< 2.2.15-72.el6.tuxcare.els18 Fix: upgrade to 2.2.15-72.el6.tuxcare.els18
TuxCare:CentOS:6	centos	httpd-manual	< 2.2.15-72.el6.tuxcare.els18 Fix: upgrade to 2.2.15-72.el6.tuxcare.els18
TuxCare:CentOS:6	centos	httpd-tools	< 2.2.15-72.el6.tuxcare.els18 Fix: upgrade to 2.2.15-72.el6.tuxcare.els18
TuxCare:CentOS:6	centos	mod_ssl	< 1:2.2.15-72.el6.tuxcare.els18 Fix: upgrade to 1:2.2.15-72.el6.tuxcare.els18

Original advisory text

httpd: Fix of CVE-2026-63292

- CVE-2026-63292: mod_vhost_alias: stack buffer overflow when a single
Host header segment exceeds HUGE_STRING_LEN; reject the expansion

References

https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1791487835.html Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63292 Vendor Advisory

Timeline

Published9 Oct 2026

Updated26 Oct 2026

First seen26 Oct 2026

Sources

CLSA-2026-1791487835 · OSV

Track software like this

Free during beta