CVE-2026-114460Medium· 5.3▾ SunlitA flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unc…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
mod_qos 11.74mod_qos 11.76mod_qos 11.79Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114458Medium· 5.9Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow
CVE-2026-114457Low· 3.7Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads
CVE-2026-114459Low· 3.7Mod_qos: out-of-bounds reads in response-body substring matching
CVE-2026-43964Low· 3.7Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
CVE-2026-12727Medium· 4.3IBM MQ Buffer Overflow
CVE-2026-111273Medium· 6.1unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name