Description
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pbuchbinder | mod_qos | 11.74, 11.76, 11.79 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mod-qos | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mod-qos | No fix yet | — |
| Ubuntu 26.04 LTS | mod-qos | No fix yet | — |
References
- https://access.redhat.com/security/cve/CVE-2026-114459 vdb-entry
- RHBZ#2558397 issue-tracking