CVE-2026-114460
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
Risk Assessment
An attacker could bypass mod_qos security rules and smuggle prohibited values in requests, potentially evading WAF filters and enabling unauthorized access. Organizations using mod_qos are exposed to unauthenticated security policy bypass.
Recommendation
Update mod_qos to a version containing the fix for this flaw. Until patched, consider additional request validation layers beyond mod_qos.
Other vulnerabilities in mod_qos
See all- CVE-2026-114459Low
A flaw was found in mod_qos where improper boundary checking when inspecting HTTP response bodies causes the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this by triggering specially crafted server responses, crashing an Apache worker process and causing a Denial of Service (DoS).
- CVE-2026-114458Medium
A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, leading to heap memory corruption and a crash of the web server process.
- CVE-2026-114457Low
A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during processing of percent-encoded input, the module reads past allocated memory boundaries, which can crash an Apache worker process.
Original NVD description (English source)
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS