CVE-2026-114459: Mod_qos: out-of-bounds reads in response-body substring matching
A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).
Other sources
A flaw was found in modqos. When QSSetEnvIfResBody is enabled, qosstrnstr() searches response buckets that need not be NUL-terminated. Its outer scan and exit checks, as well as its inner match loop, dereference input bytes before checking that they are within the supplied length, allowing reads beyond a response bucket. An unauthenticated remote client who triggers a response with suitable bucket contents and memory layout may cause an Apache worker process to crash, resulting in denial of service.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using mod_qos with QS_SetEnvIfResBody enabled are exposed when the module inspects HTTP response bodies. The vulnerable path involves response buckets that are not NUL-terminated.
What must an attacker do to trigger the crash?
An unauthenticated remote client must trigger a server response with suitable response-bucket contents and memory layout. Exploitation depends on specifically crafted responses and has high attack complexity.
What is the practical impact of successful exploitation?
Successful exploitation can crash an Apache worker process, causing denial of service. The provided information does not indicate confidentiality or integrity impact.