Live › vulnerability › CVE-2026-114460
Go to dashboardmod_qos is an Apache module that enforces request rules; an off-by-one error when merging body parameters into the URL query truncates the query during inspection. An unauthenticated remote attacker can send a crafted request that hides prohibited values from the rule check, bypassing configured security rules.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the mod_qos Apache module with rules that inspect query strings or parameters are the exposed systems. Servers without mod_qos loaded, or without request-filtering rules, are not affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
This page as .md · .json · in your agent: get_signal("CVE-2026-114460")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.