CVE-2026-114458: Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-26
Weakness: CWE-787

Description

A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.

Affected products

pbuchbinder mod_qos: 11.74, 11.76, 11.79

References

https://access.redhat.com/security/cve/CVE-2026-114458
https://bugzilla.redhat.com/show_bug.cgi?id=2558393

Get alerted when CVE-2026-114458 or the next vulnerability affects your stack