Read the docs
TI-2026-79213 Aliases CVE-2026-114457GHSA-vwh8-p4rw-9g58

Missing string termination in mod_qos JSON escaping crashes Apache

Priority LOW 18CWE-170Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

pbuchbinder mod_qos versions from 11.74, 11.76 and 11.79 are affected. Improper null termination (CWE-170) during processing of percent-encoded input lets the module read past allocated memory when JSON body filtering is enabled. An unauthenticated remote attacker can send a specially crafted JSON request that crashes an Apache worker process, causing a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pbuchbindermod_qos11.74; 11.76; 11.79—No fix listedCNA
  • mod_qos Vendorpbuchbinder Affected 11.74; 11.76; 11.79 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for mod_qos.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114457
  2. 2026-10-22 Alias added: GHSA-vwh8-p4rw-9g58
  3. 2026-10-22 Affected versions changed · Red Hat
  4. 2026-10-22 CVSS score added · Red Hat
  5. 2026-10-26 CISA SSVC decision points changed

References

Other 2

  • TI-2026-79216 Query truncation in mod_qos lets attackers bypass security rules CVSS 3.1MEDIUM 5.3
  • TI-2026-79214 Heap overflow in mod_qos connection monitor enables denial of service CVSS 3.1MEDIUM 5.9
  • TI-2026-79215 Mod_qos: out-of-bounds reads in response-body substring matching CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences