CVE-2026-114459

LowCVSS 3.7/10Last modified Oct 26, 2026

Description

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
pbuchbinder	mod_qos	11.74; 11.76; 11.79

References

Timeline

Published: Oct 22, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-114465.3The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of d CVE-2026-1144605.3A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query,CVE-2026-1144626.0Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before CVE-2026-1144637.5The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-CVE-2026-1144649.3IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.CVE-2026-1144664.4Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe CVE-2026-1144673.3Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures CVE-2026-1144694.4Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size CVE-2026-114476.3A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the c CVE-2026-1144705.3Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenti CVE-2026-1144714.7Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local us CVE-2026-1144723.7Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unau