A flaw was found in mod_qos. With mod_parp available and JSON body filtering enabled, the j_escape_url() helper can fill its allocation with percent-encoded input without leaving space for a terminating NUL byte. Subsequent query construction treats the buffer as a terminated string and may read past its end. An unauthenticated remote client can supply a crafted JSON string to trigger this out-of-bounds read, which may crash an Apache worker process.