Source: mod-qos X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for mod-qos. CVE-2026-114457[0]: | A flaw was found in mod_qos. An unauthenticated remote attacker | could cause a Denial of Service (DoS) by sending a specially crafted | JSON request when JSON body filtering is enabled. Due to improper | string termination during the processing of percent-encoded input, | the module reads past allocated memory boundaries, which can cause | an Apache worker process to crash. https://bugzilla.redhat.com/show_bug.cgi?id=2558311 CVE-2026-114458[1]: | A flaw was found in mod_qos. An unauthenticated remote attacker can | cause a Denial of Service (DoS) by maintaining numerous concurrent | low-rate connections to a target server. When connection rate | monitoring is active, the module fails to verify array boundaries | when recording client IP addresses, allowing more connection records | to be added than the allocated buffer can hold. This issue leads to | heap memory corruption, which can crash the web server process. https://bugzilla.redhat.com/show_bug.cgi?id=2558393 CVE-2026-114459[2]: | A flaw was found in mod_qos. When inspecting HTTP response bodies, | improper boundary checking can cause the module to read memory | outside allocated buffer boundaries. An unauthenticated remote | attacker can exploit this vulnerability by triggering specifically | crafted server responses, causing an Apache worker process to crash | and resulting in a Denial of Service (DoS). https://bugzilla.redhat.com/show_bug.cgi?id=2558397 CVE-2026-114460[3]: | A flaw was found in mod_qos. An off-by-one pointer calculation error | occurs when merging request body parameters with an existing URL | query, which truncates the query string during security evaluation | while leaving the actual request unchanged. An unauthenticated | remote attacker could exploit this vulnerability by submitting a | crafted request that conceals prohibited values from inspection, | resulting in a bypass of configured security rules. https://bugzilla.redhat.com/show_bug.cgi?id=2558401 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-114457 https://www.cve.org/CVERecord?id=CVE-2026-114457 [1] https://security-tracker.debian.org/tracker/CVE-2026-114458 https://www.cve.org/CVERecord?id=CVE-2026-114458 [2] https://security-tracker.debian.org/tracker/CVE-2026-114459 https://www.cve.org/CVERecord?id=CVE-2026-114459 [3] https://security-tracker.debian.org/tracker/CVE-2026-114460 https://www.cve.org/CVERecord?id=CVE-2026-114460 Please adjust the affected versions in the BTS as needed.
