DEBIAN-CVE-2026-114457

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-114457
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114457.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-114457
Upstream
  • CVE-2026-114457
Published
2026-10-22T20:47:44Z
Modified
2026-10-23T06:00:10Z
Summary
[none]
Details

A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.

References

Affected packages

Debian:14 / mod-qos

Package

Name
mod-qos
Purl
pkg:deb/debian/mod-qos?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.76-3
11.76-4
11.76-5
11.76-6
11.77-1
11.78-1
11.79-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114457.json"