Live › vulnerability › CVE-2026-114458
Go to dashboardmod_qos, an Apache HTTP Server module for connection control, fails to check array bounds when recording client IP addresses under connection rate monitoring. An unauthenticated attacker holding many low-rate connections corrupts heap memory and crashes the web server process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running the mod_qos module with connection rate monitoring active are exposed, since the flaw is in the IP recording path that only runs when that monitoring is enabled. Hosts without mod_qos, or with it loaded but rate monitoring off, are not affected per the description. Sources do not name affected or fixed versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-114458")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.