Denial of Service Vulnerability in mod_qos for Apache HTTP Server
CVE-2026-114457

3.7LOW

Key Information:

Vendor

Pbuchbinder

Status
Mod Qos
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114457?

A flaw exists in mod_qos that allows unauthenticated remote attackers to potentially trigger a Denial of Service (DoS) condition. This can occur when JSON body filtering is enabled, enabling attackers to send specially crafted JSON requests. The vulnerability arises from improper string termination during the processing of percent-encoded input, which leads to reading beyond allocated memory boundaries. As a result, this behavior can cause an Apache worker process to crash, impacting the stability and availability of the server.

Affected Version(s)

mod_qos 11.74

mod_qos 11.76

mod_qos 11.79

References

https://access.redhat.com/security/cve/CVE-2026-114457
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2558311
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Robin "drzobin" Larsson for reporting this issue.
.