Vulnerability · Published Oct 22, 2026 · Assigned by fedora
CVE-2026-114457Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
Low 3.7
In plain English
A low-severity security flaw in mod_qos from pbuchbinder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 69.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | mod-qos | no fix listed | DEBIAN-CVE-2026-114457 |
| Ubuntu:26.04:LTS | mod-qos | no fix listed | UBUNTU-CVE-2026-114457 |
| Ubuntu:26.10 | mod-qos | no fix listed | UBUNTU-CVE-2026-114457 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pbuchbinder | mod_qos | 11.7411.7611.79 |
Weakness: CWE-170 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-114457 vdb-entry, x_refsource_REDHAT
- RHBZ#2558311 issue-tracking, x_refsource_REDHAT