Read the docs
TI-2026-79215 Aliases CVE-2026-114459GHSA-j73g-g378-q257

Mod_qos: out-of-bounds reads in response-body substring matching

Priority LOW 18CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A flaw in mod_qos lets the module read memory outside allocated buffer boundaries while inspecting HTTP response bodies, because boundary checking is improper (CWE-125 Out-of-bounds Read). An unauthenticated remote attacker can trigger it with crafted server responses, crashing an Apache worker process and causing a Denial of Service. The CVSS 3.1 base score is 3.7 (LOW). The issue is tracked as CVE-2026-114459 and GHSA-j73g-g378-q257 and was published on 2026-10-22.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 31st percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pbuchbindermod_qos11.74; 11.76; 11.79—No fix listedCNA
  • mod_qos Vendorpbuchbinder Affected 11.74; 11.76; 11.79 Fixed in — No fix listed CNA

Remediation

The affected ranges start at 11.74, 11.76 and 11.79, and no fixed version is listed for them. Red Hat lists one of its products as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114459
  2. 2026-10-22 Alias added: GHSA-j73g-g378-q257
  3. 2026-10-22 Affected versions changed · Red Hat
  4. 2026-10-22 CVSS score added · Red Hat
  5. 2026-10-26 CISA SSVC decision points changed

References

Other 2

  • TI-2026-79216 Query truncation in mod_qos lets attackers bypass security rules CVSS 3.1MEDIUM 5.3
  • TI-2026-79214 Heap overflow in mod_qos connection monitor enables denial of service CVSS 3.1MEDIUM 5.9
  • TI-2026-79213 Missing string termination in mod_qos JSON escaping crashes Apache CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences