mod_qos CVE-2026-114459

Exploitation requires mod_qos to be configured to inspect HTTP response bodies (response-side content/QoS filtering must be enabled - not a default posture), and the attacker must be able to cause the server to emit specifically crafted/malformed responses, which in practice means a deployment where response content is attacker-influenced (e.g., mod_qos fronting a backend the attacker can manipulate). Limiting factors: the module itself is optional and uncommon, the response-inspection feature must be turned on, AC:H reflects the non-trivial crafting needed to trigger the out-of-bounds read, and impact is confined to availability (a single worker crash, A:L) with no data exposure. No authentication is required (PR:N) and no user interaction is needed (UI:N).

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) scores only 3.7 (Low), and the signals are internally consistent: the sole impact is availability (A:L) - an Apache worker process crash - with no confidentiality or integrity impact (C:N/I:N). AC:H correctly reflects that exploitation is not trivial: the attacker must induce specifically crafted server responses while mod_qos is inspecting response bodies. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The tag set lists 'Information Disclosure' and 'Buffer Overflow', but these conflict with the authoritative data: the CWE is CWE-125 (out-of-bounds READ, not a write/overflow), and the CVSS sets C:N with the description describing only a DoS crash - so treat the info-disclosure characterization as unconfirmed. Bottom line: a real but minor availability bug that merits patching in the normal maintenance cycle, not emergency response.

An attacker who can influence or control the content of HTTP responses passing through an Apache server running mod_qos with response-body inspection enabled (for example a reverse-proxy or content-filtering deployment with an attacker-influenced backend) crafts a malformed response. When mod_qos inspects the response body, improper boundary checking causes an out-of-bounds read that crashes the serving Apache worker process, producing a denial of service. No public exploit code is identified in the provided data, and the high attack complexity (AC:H) makes reliable triggering non-trivial.