An off‑by‑one pointer calculation in the mod_qos module causes the query string to be truncated when the request body parameters are merged with an existing URL query. The resulting truncated query is evaluated for security rules while the full request remains unchanged, allowing an unauthenticated remote attacker to conceal prohibited values in the request body and bypass the configured security rules.

mod_qos from pbuchbinder is affected. No specific version ranges were provided, so all currently deployed versions of mod_qos may have the flaw until a patch is applied.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request that merges a JSON body with an existing query string. No authentication is required, and the attack can be performed remotely from outside the protected network.