Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in mod_qos. When QS_SetEnvIfResBody is enabled, qos_strnstr() searches response buckets that need not be NUL-terminated. Its outer scan and exit checks, as well as its inner match loop, dereference input bytes before checking that they are within the supplied length, allowing reads beyond a response bucket. An unauthenticated remote client who triggers a response with suitable bucket contents and memory layout may cause an Apache worker process to crash, resulting in denial of service.