DEBIAN-CVE-2026-114458

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-114458
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114458.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-114458
Upstream
  • CVE-2026-114458
Published
2026-10-22T20:47:47Z
Modified
2026-10-23T06:00:11Z
Summary
[none]
Details

A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.

References

Affected packages

Debian:14 / mod-qos

Package

Name
mod-qos
Purl
pkg:deb/debian/mod-qos?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.76-3
11.76-4
11.76-5
11.76-6
11.77-1
11.78-1
11.79-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114458.json"