CVE-2026-114457
CVE-2026-114457 · Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
CVSS 3.7 · Low · EPSS 0.3%
- Published
- Updated
Stack: system
Affected products and versions
mod_qos
- Versions
- 11.74: Affected (custom)
- 11.76: Affected (custom)
- 11.79: Affected (custom)
No fix published
mod-qos Debian:14
- Versions
- 11.76-3
- 11.76-4
- 11.76-5
- 11.76-6
- 11.77-1
- 11.78-1
- 11.79-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mod-qos Ubuntu:26.10
- Versions
- 11.77-1
- 11.78-1
- 11.79-1
- 11.79-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mod-qos Ubuntu:26.04:LTS
- Versions
- 11.76-4
- 11.76-5
- 11.76-6
- 11.77-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published