Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in mod_qos. With mod_parp available and JSON body filtering enabled, the j_escape_url() helper can fill its allocation with percent-encoded input without leaving space for a terminating NUL byte. Subsequent query construction treats the buffer as a terminated string and may read past its end. An unauthenticated remote client can supply a crafted JSON string to trigger this out-of-bounds read, which may crash an Apache worker process.