Low severity · published Oct 22, 2026
CVE-2026-114459
Mod_qos: out-of-bounds reads in response-body substring matching
New
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
mod_qos · pbuchbinder
11.74; 11.76; 11.79 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114459
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-114459
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2558397
More from mod_qos
5.9
CVE-2026-114458
Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
5.3
CVE-2026-114460
Mod_qos: query truncation during json body merging permits security-rule bypass
3.7
CVE-2026-114457
Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads