CVE-2026-114457 — Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is ena…
Published: 2026-10-22 · CVSS: 3.7 · CVSS 3.1
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7