A flaw was found in modqos. With modparp available and JSON body filtering enabled, the jescapeurl() helper can fill its allocation with percent-encoded input without leaving space for a terminating NUL byte. Subsequent query construction treats the buffer as a terminated string and may read past its end. An unauthenticated remote client can supply a crafted JSON string to trigger this out-of-bounds read, which may crash an Apache worker process.