A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which… (CVE-2026-114460)

CVE-2026-114460 describes an off-by-one pointer calculation error in mod_qos that occurs during the merging of request body parameters with an existing URL query string. This error truncates the query string during security evaluation, but does not alter the actual request content. As a result, an attacker can craft requests that conceal prohibited values from security checks, effectively bypassing configured security rules without authentication.

The vulnerability allows unauthenticated remote attackers to bypass security rules configured in mod_qos by submitting specially crafted requests. This bypass can lead to unauthorized actions or access that would otherwise be blocked by security policies. The CVSS score of 5.3 (medium severity) reflects the limited impact on confidentiality (no data disclosure), but a confirmed integrity impact due to rule bypass. There is no impact on availability.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider additional security controls outside mod_qos to detect or block suspicious requests that might exploit this vulnerability.