{"id":"CVE-2026-114460","kind":"vulnerability","aliases":["CVE-2026-114460"],"related":[],"title":"mod_qos: off-by-one lets requests hide values from security rules","description":"A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.","summary":"mod_qos is an Apache module that enforces request rules; an off-by-one error when merging body parameters into the URL query truncates the query during inspection. An unauthenticated remote attacker can send a crafted request that hides prohibited values from the rule check, bypassing configured security rules.","severity":"medium","cvss":5.3,"epss":0.00274,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","mod_qos","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-22T07:16:42+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:30+00:00","updated_at":"2026-10-25T04:20:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:20:30Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"mod_qos: off-by-one lets requests hide values from security rules","impact":"medium","summary":"mod_qos is an Apache module that enforces request rules; an off-by-one error when merging body parameters into the URL query truncates the query during inspection. An unauthenticated remote attacker can send a crafted request that hides prohibited values from the rule check, bypassing configured security rules.","category":"runtime","nicknames":[],"who_cares":["apache","mod_qos","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Security rules are bypassed; prohibited requests reach the application.","analyst_note":"Find the affected mod_qos versions and the fixed release in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114460.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running the mod_qos Apache module with rules that inspect query strings or parameters are the exposed systems. Servers without mod_qos loaded, or without request-filtering rules, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000556,"input_tokens":3363,"output_tokens":439,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114460':16A,19A '-2026':15A,18A 'actual':114C 'apach':20B,31B 'attack':59B,120C 'bodi':45B,96C 'bypass':73B,139C 'calcul':90C 'check':72B 'conceal':131C 'configur':74B,141C 'could':121C 'craft':63B,128C 'cve':14A,17A 'enforc':34B 'error':42B,91C 'evalu':110C 'exist':100C 'exploit':122C 'flaw':78C 'found':80C 'hide':9A,66B 'host':26B 'inspect':55B,135C 'leav':112C 'let':7A 'merg':44B,94C 'mod':1A,21B,27B,82C 'modul':32B 'occur':92C 'off-by-on':3A,38B,85C 'one':6A,41B,88C 'paramet':46B,97C 'pointer':89C 'prohibit':67B,132C 'qos':2A,22B,28B,83C 'queri':50B,53B,102C,106C 'remot':58B,119C 'request':8A,35B,64B,95C,115C,129C 'result':136C 'rule':13A,36B,71B,76B,143C 'runtim':23B 'secur':12A,75B,109C,142C 'self':25B 'self-host':24B 'send':61B 'string':107C 'submit':126C 'truncat':51B,104C 'unauthent':57B,118C 'unchang':116C 'url':49B,101C 'valu':10A,68B,133C 'vulner':124C","nicknames":[],"mitigations":[],"who_affected":"Sites running the mod_qos Apache module with rules that inspect query strings or parameters are the exposed systems. Servers without mod_qos loaded, or without request-filtering rules, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"patrick@puiterwijk.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114460","severity":null,"published_at":"2026-10-22T07:16:42+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114460","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114460","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}