{"id":"CVE-2026-114460","aliases":[],"cve":{"records":[{"id":"CVE-2026-114460","source":"fedora","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-21T14:38:50.235Z","published":"2026-10-22T06:37:07.818Z","modified":"2026-10-30T18:34:08.202Z"}],"publishers":[{"name":"fedora","role":"CNA","organizationId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","modified":"2026-10-22T06:37:07.818Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:34:08.202Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-114460","tags":["vdb-entry","x_refsource_REDHAT"],"source":"fedora"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558401","tags":["issue-tracking","x_refsource_REDHAT"],"source":"fedora"}],"weaknesses":[{"id":"CWE-193","description":"Off-by-one Error","source":"fedora"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T18:32:37.906519Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Mod_qos: query truncation during json body merging permits security-rule bypass","titleSource":"fedora","descriptionSource":"fedora","description":"A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.","score":5.3,"severity":"medium","published":"2026-10-22T06:37:07.818Z","modified":"2026-10-30T18:34:08.202Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"pbuchbinder","name":"mod_qos","platforms":[],"versions":[{"version":"11.74","status":"affected","versionType":"custom"},{"version":"11.76","status":"affected","versionType":"custom"},{"version":"11.79","status":"affected","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"fedora","url":"https://www.cve.org/CVERecord?id=CVE-2026-114460"}],"remediation":[],"references":["https://access.redhat.com/security/cve/CVE-2026-114460","https://bugzilla.redhat.com/show_bug.cgi?id=2558401"],"sources":[{"name":"CVE","id":"CVE-2026-114460","modified":"2026-10-30T18:34:08.202Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114460"}],"assessments":[{"source":"fedora","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-30T18:58:58.767Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:20:32.820Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Mod_qos versions 11.74, 11.76, and 11.79 have a flaw that allows an unauthenticated remote attacker to bypass security rules by submitting a crafted request. The vulnerability is due to an off-by-one pointer calculation error when merging request body parameters with an existing URL query. This error truncates the query string during security evaluation.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T10:16:04.947Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-114460"}]}}