CVE-2026-114457Low· 3.7▾ SunlitA flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
0.3% → 0.4%
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
mod_qos 11.74mod_qos 11.76mod_qos 11.79Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114458Medium· 5.9Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
CVE-2026-114459Low· 3.7Mod_qos: out-of-bounds reads in response-body substring matching
CVE-2026-114460Medium· 5.3Mod_qos: query truncation during json body merging permits security-rule bypass
CVE-2026-57185Medium· 6.5Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-5067Critical· 9.8A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header
CVE-2026-96860Medium· 5.5Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.