Ubuntu's USN-8931-1 advisory on 14 October 2026 covered nine CVEs in Apache httpd, and the most consequential is CVE-2026-63292, a stack-based buffer overflow in mod_vhost_alias. NVD scores it 7.5 and describes the trigger precisely: a remote client sends an HTTP request whose Host header exceeds 8,192 bytes, while VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize has been raised above its default.
Every part of that condition is checkable. Together they make this a case where the exposure question has a real answer, and where internet-wide product counts are almost entirely beside the point.
ZoomEye queries for this article could not be executed because the API returned HTTP 502 during the research window. No counts appear below.

Counting Apache tells you very little here

app="Apache" and http.header.server="Apache" return large numbers that have been stable for years, because Apache httpd runs a substantial fraction of the web. The figure says something about the internet's composition and nothing about CVE-2026-63292.
The reason is that mod_vhost_alias is not loaded by default in most distributions, and VirtualDocumentRoot with a hostname format specifier is a configuration choice used by shared hosting providers and by platforms that map hostnames to directory trees. A server running Apache with a handful of virtual hosts defined by VirtualHost blocks does not have the vulnerable path at all.
The second condition narrows further. LimitRequestFieldSize defaults to 8,190 bytes. The advisory requires that it be raised, which an administrator does to accommodate unusual header sizes, typically for authentication tokens or for a legacy application that sends oversized headers.
The intersection of "uses mod_vhost_alias with hostname format specifiers" and "raised LimitRequestFieldSize" is a small configuration population. Measuring it requires configuration access, not scanning.

What scanning can contribute

Scan results can identify candidate organisations rather than candidate hosts. A hosting provider with thousands of hostnames resolving to the same address space, where response content varies by Host header, is structurally the kind of deployment that uses mod_vhost_alias.
That pattern is visible through ssl.cert.subject.cn and through the relationship between hostnames and IP addresses, both of which ZoomEye exposes:

ssl="*.example-hosting-domain"
http.header.server="Apache" && port=443

The first query describes wildcard-certificate deployments, which frequently accompany hostname-driven virtual hosting. The second gives the population of TLS-terminating Apache servers to sample from.
Sampling is the word that matters. A single request with an oversized Host header against a server you are authorised to test answers the question definitively. A scan can only suggest where to look.

The header-size relationship worth understanding

LimitRequestFieldSize interacts with LimitRequestLine and with the reverse proxy in front of the server. A deployment behind nginx or a load balancer with its own header limits may be protected by the front end even when Apache's own limit is raised.
That possibility is not a mitigation the vendor endorses, and it should not be reported as one. It does mean that a scan-based assessment of a fronted Apache server can easily reach the wrong conclusion in either direction.

What the other eight CVEs add

USN-8931-1 also covered a WebDAV information disclosure (CVE-2026-58415), a Digest authentication man-in-the-middle issue (CVE-2026-73636), and a user-directory information disclosure (CVE-2026-79768), among others.
Each of these maps to a configuration feature rather than to the product as a whole. WebDAV being enabled, Digest authentication being in use, and mod_userdir being loaded are all checkable properties, and none of them appear in a scan response as anything other than an inference from behaviour.
That is the general lesson from this batch. For a mature web server with a decade of conditional CVEs, the useful measurement unit is the configuration, and the useful tool is a configuration inventory that somebody maintains. Scanning finds the assets that inventory missed; it does not replace the inventory.

References

  • Ubuntu Security Notice USN-8931-1, 14 October 2026, covering nine Apache httpd CVEs

  • NVD entry for CVE-2026-63292, CWE-121, CVSS v3.1 7.5, with the Host header and LimitRequestFieldSize conditions

  • Apache HTTP Server 2.4.69 release notes

  • ZoomEye official MCP search syntax reference for app, http.header.server, ssl and port