CVE-2026-114458
Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
- State
- Published
- Severity
- 5.9 Medium
- Published
- Oct 22, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 21, 2026
Description
A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | fedora |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
mod_qospbuchbinder |
|
References
- https://access.redhat.com/security/cve/CVE-2026-114458vdb-entry
- RHBZ#2558393issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.