mod_qos CVE-2026-114460

Exploitation requires mod_qos to be deployed on an Apache HTTP Server and configured with security/QoS rules that inspect request query parameters (the directives that merge request-body parameters into the URL query for evaluation). The attack hinges on that parameter-merging code path, where an off-by-one pointer calculation truncates the string under inspection. Limiting factors: the bug only grants value in environments that actually depend on mod_qos filtering to block prohibited input - if mod_qos is absent or not used for query/parameter security rules, there is no exploitable condition, and the impact is confined to evading those filter rules rather than any direct code execution or data disclosure.

This is a moderate-severity security-control bypass in mod_qos, an add-on Apache HTTP Server module used for quality-of-service and request filtering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: a remote, unauthenticated attacker over the network, with low complexity, achieves only a limited integrity impact (I:L) and no confidentiality or availability impact. The integrity rating is appropriate because the bug does not directly compromise data or systems - it causes an off-by-one truncation of the query string during security evaluation, so prohibited values slip past the configured filter while the unmodified request still reaches the backend. Crucially, impact is conditional: the vulnerability only matters where mod_qos is actively relied upon to enforce security rules, which bounds real-world risk. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The score should NOT be read as 'authentication bypass' despite the input tag - the description describes evasion of configured security rules, not bypass of authentication, so the risk is that of a WAF/filter evasion primitive rather than direct account compromise. Affected version data is absent from the provided references, which limits precise exposure assessment.

An attacker sends a crafted HTTP request that merges request-body parameters with the existing URL query string in a way that triggers the off-by-one truncation during mod_qos's security evaluation. The truncated string hides a prohibited value from inspection, so a configured QoS/filter rule that would normally block the request passes it through to the application unchanged. No public exploit code was identified at time of analysis; the attack is remote and unauthenticated with low complexity (AV:N/AC:L/PR:N).