---
id: "CVE-2026-114459"
kind: "vulnerability"
aliases: ["CVE-2026-114459"]
title: "mod_qos: out-of-bounds read in response inspection lets remote crash Apache workers"
severity: "low"
cvss: 3.7
epss: 0.0028
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache", "mod_qos", "runtime"]
not_affected_if: []
published_at: "2026-10-22T07:16:42+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:43:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114459", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114459", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# mod_qos: out-of-bounds read in response inspection lets remote crash Apache workers

mod_qos, an Apache HTTP Server module, reads memory past the end of a buffer while inspecting HTTP response bodies. A remote unauthenticated attacker can send crafted server responses that crash an Apache worker process, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114459
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114459

## From the sources

A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_