A flaw in the Mod_qos module allows an unauthenticated remote attacker to cause a denial of service by creating many concurrent low‑rate connections. When connection‑rate monitoring is enabled the module does not check array bounds while recording client IP addresses, resulting in a heap buffer overflow and eventual server crash. The principal impact is service disruption; no evidence of arbitrary code execution is provided in the description.

This vulnerability affects deployments that include the Mod_qos module, typically within Apache HTTP Server environments. Specific product versions are not disclosed in the advisory, so any instance of Mod_qos running on a server without an identified patch may be vulnerable. The legacy version of the module included in the referenced packages is the one that exhibits the issue.

The CVSS score of 5.9 indicates moderate severity, but the vulnerability is exploitable by any unauthenticated attacker with network access to the target. Because the attack leverages sustained, low‑rate connections, the exploit can be carried out at any time without privileged credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely observed in the wild. Nevertheless, the attack vector is external and relies only on normal traffic patterns, making the risk of exploitation significant for exposed web servers.