mod_qos CVE-2026-114457

Exploitation requires that mod_qos JSON body filtering be explicitly enabled - this is a non-default feature configuration, so servers running default mod_qos settings are not exposed. The attacker needs no authentication (PR:N) and can reach the server remotely (AV:N), but must craft specific malformed percent-encoded JSON input, and the high attack complexity (AC:H) reflects dependence on memory layout to reliably trigger the out-of-bounds read. Impact is limited to crashing an individual Apache worker process (A:L), which is typically respawned, rather than a persistent full-service outage; there is no confidentiality or integrity impact.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base 3.7) tells a consistent story: remotely reachable (AV:N) and no privileges required (PR:N), but high attack complexity (AC:H) and only limited availability impact (A:L) with no confidentiality or integrity effect. The limited impact reflects that the flaw crashes a single Apache worker process - which the server parent typically respawns - rather than taking down the whole service. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AC:H rating and the requirement that non-default JSON body filtering be enabled further constrain real-world exploitability. All signals (low CVSS, limited availability-only impact, no exploitation evidence, config-dependent trigger) align toward low real risk; there is no conflict between the signals to flag. Note that mod_qos is a third-party add-on module, not part of core Apache httpd, which further narrows the exposed population.

An attacker who identifies an Apache server running mod_qos with JSON body filtering enabled sends a specially crafted JSON request containing malformed percent-encoded input. The improper string termination causes mod_qos to read past allocated memory and crash the handling worker process, producing a transient denial of service. No public exploit code is identified at time of analysis, and the high attack complexity means reliable triggering may require tuning to the target's memory layout.