{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114458",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T19:24:17.939732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T19:38:30.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://svn.code.sf.net/p/mod-qos/source/",
          "defaultStatus": "unknown",
          "packageName": "mod_qos",
          "product": "mod_qos",
          "vendor": "pbuchbinder",
          "versions": [
            {
              "status": "affected",
              "version": "11.74",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.76",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.79",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Robin \"drzobin\" Larsson for reporting this issue."
        }
      ],
      "datePublic": "2026-10-21T14:45:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T06:37:04.887Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-114458"
        },
        {
          "name": "RHBZ#2558393",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558393"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-17T14:23:45.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-21T14:45:26.000Z",
          "value": "Made public."
        }
      ],
      "title": "Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-114458",
    "datePublished": "2026-10-22T06:37:04.887Z",
    "dateReserved": "2026-10-21T14:38:50.235Z",
    "dateUpdated": "2026-10-26T19:38:30.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-114458\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-26T19:24:17.939732Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-26T19:31:42.757Z\"}}], \"cna\": {\"title\": \"Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Robin \\\"drzobin\\\" Larsson for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"pbuchbinder\", \"product\": \"mod_qos\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.74\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"11.76\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"11.79\", \"versionType\": \"custom\"}], \"packageName\": \"mod_qos\", \"collectionURL\": \"https://svn.code.sf.net/p/mod-qos/source/\", \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-17T14:23:45.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-10-21T14:45:26.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-10-21T14:45:26.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-114458\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2558393\", \"name\": \"RHBZ#2558393\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5\", \"shortName\": \"fedora\", \"dateUpdated\": \"2026-10-22T06:37:04.887Z\"}, \"x_redhatCweChain\": \"CWE-787: Out-of-bounds Write\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-114458\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-26T19:38:30.811Z\", \"dateReserved\": \"2026-10-21T14:38:50.235Z\", \"assignerOrgId\": \"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5\", \"datePublished\": \"2026-10-22T06:37:04.887Z\", \"assignerShortName\": \"fedora\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}