diff --git a/changes-entries/vhost-alias-interpolate-nul.txt b/changes-entries/vhost-alias-interpolate-nul.txt
new file mode 100644
index 00000000000..0aa6df88b94
--- /dev/null
+++ b/changes-entries/vhost-alias-interpolate-nul.txt
@@ -0,0 +1,4 @@
+  *) mod_vhost_alias: Reserve a byte for the terminating NUL when
+     interpolating VirtualDocumentRoot/VirtualScriptAlias, so a name of
+     a length that fills the buffer exactly cannot write one byte past
+     it.  [arshiya tabasum]
diff --git a/modules/mappers/mod_vhost_alias.c b/modules/mappers/mod_vhost_alias.c
index 9e7b06e3af2..e45c8c2fd40 100644
--- a/modules/mappers/mod_vhost_alias.c
+++ b/modules/mappers/mod_vhost_alias.c
@@ -244,7 +244,10 @@ static APR_INLINE int vhost_alias_checkspace(request_rec *r, char *buf,
                       "VirtualDocumentRoot expansion too large");
         return HTTP_REQUEST_URI_TOO_LARGE;
     }
-    if (*pdest + size > buf + HUGE_STRING_LEN) {
+    /* Reserve one byte for the terminating NUL: dest must never reach
+     * buf + HUGE_STRING_LEN, or the '\0' written here and at the end of
+     * vhost_alias_interpolate() lands one byte past the buffer. */
+    if (*pdest + size >= buf + HUGE_STRING_LEN) {
         **pdest = '\0';
         if (r->filename) {
             r->filename = apr_pstrcat(r->pool, r->filename, buf, NULL);