Hi,

The following vulnerabilities were published for mod-qos.

CVE-2026-114457[0]:
| A flaw was found in mod_qos. An unauthenticated remote attacker
| could cause a Denial of Service (DoS) by sending a specially crafted
| JSON request when JSON body filtering is enabled. Due to improper
| string termination during the processing of percent-encoded input,
| the module reads past allocated memory boundaries, which can cause
| an Apache worker process to crash.

https://bugzilla.redhat.com/show_bug.cgi?id=2558311

CVE-2026-114458[1]:
| A flaw was found in mod_qos. An unauthenticated remote attacker can
| cause a Denial of Service (DoS) by maintaining numerous concurrent
| low-rate connections to a target server. When connection rate
| monitoring is active, the module fails to verify array boundaries
| when recording client IP addresses, allowing more connection records
| to be added than the allocated buffer can hold. This issue leads to
| heap memory corruption, which can crash the web server process.

https://bugzilla.redhat.com/show_bug.cgi?id=2558393

CVE-2026-114459[2]:
| A flaw was found in mod_qos. When inspecting HTTP response bodies,
| improper boundary checking can cause the module to read memory
| outside allocated buffer boundaries. An unauthenticated remote
| attacker can exploit this vulnerability by triggering specifically
| crafted server responses, causing an Apache worker process to crash
| and resulting in a Denial of Service (DoS).

https://bugzilla.redhat.com/show_bug.cgi?id=2558397

CVE-2026-114460[3]:
| A flaw was found in mod_qos. An off-by-one pointer calculation error
| occurs when merging request body parameters with an existing URL
| query, which truncates the query string during security evaluation
| while leaving the actual request unchanged. An unauthenticated
| remote attacker could exploit this vulnerability by submitting a
| crafted request that conceals prohibited values from inspection,
| resulting in a bypass of configured security rules.

https://bugzilla.redhat.com/show_bug.cgi?id=2558401


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114457
https://www.cve.org/CVERecord?id=CVE-2026-114457
[1] https://security-tracker.debian.org/tracker/CVE-2026-114458
https://www.cve.org/CVERecord?id=CVE-2026-114458
[2] https://security-tracker.debian.org/tracker/CVE-2026-114459
https://www.cve.org/CVERecord?id=CVE-2026-114459
[3] https://security-tracker.debian.org/tracker/CVE-2026-114460
https://www.cve.org/CVERecord?id=CVE-2026-114460

Please adjust the affected versions in the BTS as needed.