CVE-2026-114458: Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using mod_qos with connection rate monitoring active are exposed. The issue is reachable remotely and does not require authentication.
What must an attacker do to trigger the denial of service?
An attacker must maintain numerous concurrent low-rate connections to the target server. This causes connection-monitor records to exceed the allocated scratch array and can corrupt heap memory, crashing the web server process.
What is the expected impact?
The stated impact is denial of service through a web server process crash. The provided information does not claim confidentiality or integrity impact.