Denial of Service Flaw in mod_qos Affects Red Hat Servers
CVE-2026-114458

5.9MEDIUM

Key Information:

Vendor

Pbuchbinder

Status
Mod Qos
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114458?

A security flaw exists in mod_qos, allowing an unauthenticated remote attacker to initiate a Denial of Service condition. By maintaining numerous concurrent low-rate connections to the targeted server, the attacker exploits a failure in connection rate monitoring, which does not properly check array boundaries when logging client IP addresses. This oversight permits the addition of more connection records than the buffer can accommodate, leading to heap memory corruption and subsequent crashes of the web server process.

Affected Version(s)

mod_qos 11.74

mod_qos 11.76

mod_qos 11.79

References

https://access.redhat.com/security/cve/CVE-2026-114458
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2558393
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Robin "drzobin" Larsson for reporting this issue.
.