Mod_qos: out-of-bounds reads in response-body substring matching
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).
CVE-2026-114459
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-114459
mod_qos
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "pbuchbinder",
"product": "mod_qos",
"versions": [
{
"status": "affected",
"version": "11.74",
"versionType": "custom"
},
{
"status": "affected",
"version": "11.76",
"versionType": "custom"
},
{
"status": "affected",
"version": "11.79",
"versionType": "custom"
}
],
"packageName": "mod_qos",
"collectionURL": "https://svn.code.sf.net/p/mod-qos/source/",
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-114459
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #50138 · Revision 1
- Added to Heist Feed
- Publisher date