A flaw was found in mod_qos. When QS_SetEnvIfResBody is enabled, qos_strnstr() searches response buckets that need not be NUL-terminated. Its outer scan and exit checks, as well as its inner match loop, dereference input bytes before checking that they are within the supplied length, allowing reads beyond a response bucket. An unauthenticated remote client who triggers a response with suitable bucket contents and memory layout may cause an Apache worker process to crash, resulting in denial of service.