Bug 2558397 (CVE-2026-114459)

Summary: CVE-2026-114459 mod_qos: Out-of-bounds reads in response-body substring matching
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2558445, 2558446    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-21 17:26:24 UTC 
A flaw was found in mod_qos. When QS_SetEnvIfResBody is enabled, qos_strnstr() searches response buckets that need not be NUL-terminated. Its outer scan and exit checks, as well as its inner match loop, dereference input bytes before checking that they are within the supplied length, allowing reads beyond a response bucket. An unauthenticated remote client who triggers a response with suitable bucket contents and memory layout may cause an Apache worker process to crash, resulting in denial of service.