CVE-2026-114457: Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
Other sources
A flaw was found in modqos. With modparp available and JSON body filtering enabled, the jescapeurl() helper can fill its allocation with percent-encoded input without leaving space for a terminating NUL byte. Subsequent query construction treats the buffer as a terminated string and may read past its end. An unauthenticated remote client can supply a crafted JSON string to trigger this out-of-bounds read, which may crash an Apache worker process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache deployments using mod_qos are exposed when mod_parp is available and JSON body filtering is enabled. The vulnerable processing path is reached while handling JSON requests containing percent-encoded input.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to send a specially crafted JSON request with percent-encoded input to a reachable affected server; exploitation has high attack complexity.
What is the expected impact of successful exploitation?
The out-of-bounds read may crash an Apache worker process, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.
What can be done if a fix cannot be applied immediately?
Disable JSON body filtering in mod_qos where operationally feasible. The described vulnerable path also depends on mod_parp being available.