mod_qos CVE-2026-114458

Exploitation requires that mod_qos connection rate monitoring is active on the target (e.g. per-client connection/rate tracking directives enabled) - this is the specific feature whose IP-record array is overflowed, and the vulnerable code path is not reached if that monitoring is not configured. The attacker must also establish and sustain numerous concurrent low-rate connections simultaneously to exceed the record buffer, reflected in the CVSS AC:H rating; a single or small number of connections will not trigger the overflow. No authentication or user interaction is needed (PR:N/UI:N). The practical limiter is therefore the non-default configuration (mod_qos installed and rate monitoring enabled) plus the sustained-connection effort required.

This is a genuine but moderate-priority issue, consistent with its CVSS 3.1 base score of 5.9 (Medium). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H shows a network-reachable, unauthenticated flaw (PR:N, AV:N) with no confidentiality or integrity impact and availability-only impact (C:N/I:N/A:H) - fully aligned with the described DoS/crash outcome. The key limiting signal is AC:H: the attacker must maintain numerous concurrent low-rate connections to win the out-of-bounds write race, so exploitation is not trivially reliable. No EPSS score was provided (unknown exploitation probability), the CVE is NOT on CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis. There is no SSVC decision data in the input. Net: a real, remotely triggerable DoS worth patching on exposed servers, but not an emergency - no evidence of active exploitation and the availability-only impact plus high attack complexity keep real-world urgency modest. Note the heap corruption (CWE-787) could in principle have worse-than-DoS potential, but the description and CVSS (I:N) scope impact to a crash only.

A remote, unauthenticated attacker opens and sustains a large number of concurrent low-rate connections to an Apache server running mod_qos with connection rate monitoring enabled. Because the module does not verify array bounds when recording client IP connection records, the flood pushes more records than the allocated buffer holds, corrupting heap memory and crashing the web server process. No public exploit is referenced, and the high attack complexity means the attacker may need repeated attempts to reliably trigger the corruption.