{"id":"CVE-2026-114458","kind":"vulnerability","aliases":["CVE-2026-114458"],"related":[],"title":"mod_qos: unauthenticated remote attacker crashes Apache web server process","description":"A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.","summary":"mod_qos, an Apache HTTP Server module for connection control, fails to check array bounds when recording client IP addresses under connection rate monitoring. An unauthenticated attacker holding many low-rate connections corrupts heap memory and crashes the web server process.","severity":"medium","cvss":5.9,"epss":0.0031,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","mod_qos","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-22T07:16:42+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:08:00+00:00","updated_at":"2026-10-25T04:08:00+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:08:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"mod_qos: unauthenticated remote attacker crashes Apache web server process","impact":"low","summary":"mod_qos, an Apache HTTP Server module for connection control, fails to check array bounds when recording client IP addresses under connection rate monitoring. An unauthenticated attacker holding many low-rate connections corrupts heap memory and crashes the web server process.","category":"runtime","nicknames":[],"who_cares":["apache","mod_qos","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Web server process crashes from remote heap corruption, causing denial of service","analyst_note":"Find affected and fixed mod_qos versions and a detection method from the NVD entry and the upstream mod_qos project.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Servers running the mod_qos module with connection rate monitoring active are exposed, since the flaw is in the IP recording path that only runs when that monitoring is enabled. Hosts without mod_qos, or with it loaded but rate monitoring off, are not affected per the description. Sources do not name affected or fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000568,"input_tokens":3374,"output_tokens":461,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114458':13A,16A '-2026':12A,15A 'activ':101C 'add':120C 'address':43B,113C 'alloc':123C 'allow':114C 'apach':7A,17B,27B 'array':37B,107C 'attack':5A,50B,76C 'bound':38B 'boundari':108C 'buffer':124C 'caus':78C 'check':36B 'client':41B,111C 'concurr':87C 'connect':32B,45B,56B,91C,97C,116C 'control':33B 'corrupt':57B,133C 'crash':6A,61B,136C 'cve':11A,14A 'denial':80C 'dos':83C 'fail':34B,104C 'flaw':67C 'found':69C 'heap':58B,131C 'hold':51B,126C 'host':23B 'http':28B 'ip':42B,112C 'issu':128C 'lead':129C 'low':54B,89C 'low-rat':53B,88C 'maintain':85C 'mani':52B 'memori':59B,132C 'mod':1A,18B,24B,71C 'modul':30B,103C 'monitor':47B,99C 'numer':86C 'process':10A,65B,140C 'qos':2A,19B,25B,72C 'rate':46B,55B,90C,98C 'record':40B,110C,117C 'remot':4A,75C 'runtim':20B 'self':22B 'self-host':21B 'server':9A,29B,64B,95C,139C 'servic':82C 'target':94C 'unauthent':3A,49B,74C 'verifi':106C 'web':8A,63B,138C","nicknames":[],"mitigations":[],"who_affected":"Servers running the mod_qos module with connection rate monitoring active are exposed, since the flaw is in the IP recording path that only runs when that monitoring is enabled. Hosts without mod_qos, or with it loaded but rate monitoring off, are not affected per the description. Sources do not name affected or fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"patrick@puiterwijk.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114458","severity":null,"published_at":"2026-10-22T07:16:42+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114458","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114458","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}