During JSON body filtering, mod_qos fails to terminate strings correctly when processing percent-encoded input. The missing null termination causes the module to read beyond allocated memory boundaries, which can trigger an Apache worker crash. This behavior enables a remote attacker to cause a denial of service by sending a specially crafted JSON request.

The vulnerability affects the pbuchbinder mod_qos module for Apache HTTP Server. No specific versions are listed in the CNA data, so all installations of this module with JSON body filtering enabled may be at risk.

The CVSS base score of 3.7 indicates low severity, and the EPSS score is not available, making it unclear how frequently this flaw is exploited in the wild. The vulnerability is not listed in CISA KEV. Attackers can trigger it remotely without authentication, assuming JSON body filtering is active. The risk of a DoS attack remains significant, especially in environments where high availability is critical.