Live › vulnerability › CVE-2026-114457
Go to dashboardmod_qos, an Apache module, reads past allocated memory when it processes percent-encoded input in JSON body filtering. An unauthenticated remote attacker can send a crafted JSON request to crash an Apache worker process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running Apache with mod_qos where JSON body filtering is enabled are exposed, since the flaw is in that processing path. Servers without mod_qos, or with JSON body filtering turned off, are not affected according to the description.
No product ranges from the sources yet.
mod_qos module is loaded in the Apache configuration (apachectl -M | grep qos).Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-114457")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.