CVE-2026-114460 debrief: Mod_qos query truncation during JSON body merging permits security-rule bypass. The vulnerability occurs due to an off-by-one pointer calculation error when merging request body parameters with an existing URL query, truncating the query string during security evaluation. This allows an unauthenticated remote attacker to bypass configured security rules by submitting a crafted req [truncated]
A flaw in mod_qos causes out-of-bounds reads when inspecting HTTP response bodies. An unauthenticated remote attacker can exploit this by triggering crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS). The vulnerability affects mod_qos deployments in Apache configurations. Defenders should assess exposure and prioritize verification and mitigation [truncated]
CVE-2026-114458 is a medium-severity vulnerability in mod_qos, which can lead to a Denial of Service (DoS) condition. An unauthenticated remote attacker can cause the issue by maintaining numerous concurrent low-rate connections to a target server. The module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold [truncated]
CVE-2026-114457: Mod_qos JSON value escaping flaw permits out-of-bounds reads, allowing unauthenticated remote attackers to cause Denial of Service (DoS) by sending specially crafted JSON requests when JSON body filtering is enabled. The flaw causes improper string termination during percent-encoded input processing, leading to Apache worker process crashes. Defenders and administrators using mod_qos in A [truncated]
