mod_qos vulnerabilities
CVEs whose affected-version data names the mod_qos package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-114458Medium· 5.9Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails t…
CVE-2026-114457Low· 3.7Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processi…
CVE-2026-114460Medium· 5.3Mod_qos: query truncation during json body merging permits security-rule bypass
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unc…
CVE-2026-114459Low· 3.7Mod_qos: out-of-bounds reads in response-body substring matching
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by t…