CVE-2026-114460: Mod_qos: query truncation during json body merging permits security-rule bypass
A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a crafted request. No user interaction or prior privileges are required.
What configurations are exposed?
Deployments using mod_qos security rules that inspect merged request body parameters and URL query data are exposed to rule bypass. The issue affects security evaluation, while the actual request remains unchanged.
What does an attacker need to include in a request?
The attacker needs to craft a request that triggers query truncation during JSON body merging, so prohibited values are concealed from mod_qos inspection. The provided data does not specify an exact payload.
How can we determine whether an attempted bypass succeeded?
Compare the query string seen by mod_qos during security evaluation with the query data processed by the application. A discrepancy in which security inspection sees a truncated query while the application receives the full request indicates the affected behavior.