Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-114459 EUVD-2026-108023GHSA-j73g-g378-q257

Mod_qos: out-of-bounds reads in response-body substring matching

Published Oct 22, 2026 · Updated Oct 26, 2026 · Assigned by fedora

Description

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

Affected products

VendorProductAffectedFixed
pbuchbinder mod_qos 11.74, 11.76, 11.79 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mod-qos No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mod-qos No fix yet —
Ubuntu 26.04 LTS mod-qos No fix yet —

References