CVE-2026-114460: Off-by-one Error in pbuchbinder mod_qos

The vulnerability in pbuchbinder mod_qos arises from an off-by-one error in pointer calculation when merging request body parameters with an existing URL query string. This error truncates the query string during security evaluation, but the actual request remains intact. As a result, an attacker can craft requests that hide prohibited values from the security inspection process, effectively bypassing configured security rules without authentication. The affected versions are 11.74, 11.76, and 11.79. No known exploits are reported in the wild. The CVSS 3.1 base score is 5.3, reflecting a network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An unauthenticated remote attacker can bypass security rules configured in mod_qos by exploiting the off-by-one error that causes truncation of the query string during security evaluation. This allows the attacker to conceal prohibited values from inspection, potentially enabling unauthorized actions or access that the security rules were intended to block. There is no direct impact on confidentiality or availability, but integrity is affected to a limited extent.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-114460 for current remediation guidance. Until an official fix is available, review mod_qos configurations and consider additional security controls to detect or block suspicious requests that might exploit this vulnerability.