CVE-2026-114460
Last modified
CVE-2026-114460 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| pbuchbinder | mod_qos | 11.74; 11.76; 11.79 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-114460?
How severe is CVE-2026-114460?
How do I fix CVE-2026-114460?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114443The Security Plugin, Firewall & Malware Scanner with Auto Re…7.5
- CVE-2026-114444The Security Plugin, Firewall & Malware Scanner with Auto Re…4.4
- CVE-2026-114457A flaw was found in mod_qos. An unauthenticated remote attac…3.7
- CVE-2026-114458A flaw was found in mod_qos. An unauthenticated remote attac…5.9
- CVE-2026-114459A flaw was found in mod_qos. When inspecting HTTP response b…3.7
- CVE-2026-11446The Booktics – Booking Calendar for Appointments and Service…5.3
- CVE-2026-114462Improper link resolution before file access ('link following…6
- CVE-2026-114463The webhook platform gateway in Nous Research Hermes Agent v…7.5
- CVE-2026-11447A security flaw has been discovered in GL.iNet GL-MT3000 up …6.3
- CVE-2026-114470Cross-site request forgery in the REST API of Progressive Ro…5.3
- CVE-2026-114471Insertion of sensitive information into a log file in the SM…4.7
- CVE-2026-114472Insufficient resource pool in the ACME HTTP-01 challenge res…3.7
Are you affected by CVE-2026-114460?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST