---
id: "CVE-2026-114460"
kind: "vulnerability"
aliases: ["CVE-2026-114460"]
title: "mod_qos: off-by-one lets requests hide values from security rules"
severity: "medium"
cvss: 5.3
epss: 0.00274
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache", "mod_qos", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-22T07:16:42+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114460", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114460", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# mod_qos: off-by-one lets requests hide values from security rules

mod_qos is an Apache module that enforces request rules; an off-by-one error when merging body parameters into the URL query truncates the query during inspection. An unauthenticated remote attacker can send a crafted request that hides prohibited values from the rule check, bypassing configured security rules.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114460
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114460

## From the sources

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_