CVE-2026-114457Low· 3.7▾ SunlitA flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
mod_qos 11.74mod_qos 11.76mod_qos 11.79Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114458Medium· 5.9Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
CVE-2026-114460Medium· 5.3Mod_qos: query truncation during json body merging permits security-rule bypass
CVE-2026-114459Low· 3.7Mod_qos: out-of-bounds reads in response-body substring matching
CVE-2026-5067Critical· 9.8Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
CVE-2026-96860Medium· 5.5Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
CVE-2026-96850Medium· 5.5Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.