CVE-2026-114460

A flaw in mod_qos involves an off-by-one pointer calculation error that occurs when merging request body parameters with an existing URL query. This error causes the query string to be truncated during security evaluation while the actual request remains unchanged. An unauthenticated remote attac...

CVE-2026-114460 Mod_qos: query truncation during json body merging permits security-rule bypass

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...