12 matches found
CVE-2026-114460 Mod_qos: query truncation during json body merging permits security-rule bypass
A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...
CVE-2026-114460
A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...
CVE-2026-114459 Mod_qos: out-of-bounds reads in response-body substring matching
A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...
CVE-2026-114459
A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...
CVE-2026-114458 Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service DoS by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses,...
CVE-2026-114458
A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service DoS by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses,...
CVE-2026-114457 Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...
CVE-2026-114457
A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...
CVE-2026-114459
A flaw was found in modqos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...
CVE-2026-114457
A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...
CVE-2026-114460
A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...
CVE-2026-114458
A flaw was found in modqos. An unauthenticated remote attacker can cause a Denial of Service DoS by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses,...