A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request… (CVE-2026-114457)

CVE-2026-114457 describes a flaw in the mod_qos module where improper string termination during percent-encoded input processing causes the module to read beyond allocated memory boundaries. This can be triggered by an unauthenticated remote attacker sending a specially crafted JSON request when JSON body filtering is enabled, resulting in a Denial of Service by crashing Apache worker processes. The vulnerability is rated with a CVSS 3.1 base score of 3.7, reflecting low severity and requiring high attack complexity.

The vulnerability allows an unauthenticated attacker to cause a Denial of Service condition by crashing Apache worker processes. There is no impact on confidentiality or integrity. The attack complexity is high, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling JSON body filtering in mod_qos if feasible to prevent exploitation of this issue.