ALSA-2026:93924: Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/qt5-qtbaseto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-commonto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-develto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-examplesto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-guito a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-mysqlto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-odbcto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-postgresqlto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-private-develto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
almalinux/qt5-qtbase-staticto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10
Event History
Frequently Asked Questions
Which installed packages should be checked when assessing exposure?
Check for the listed AlmaLinux qt5-qtbase packages: qt5-qtbase, qt5-qtbase-common, qt5-qtbase-devel, qt5-qtbase-examples, qt5-qtbase-gui, qt5-qtbase-mysql, qt5-qtbase-odbc, and qt5-qtbase-postgresql. The advisory identifies these packages as affected by the update.
What impact do the addressed issues have?
Both identified issues are denial-of-service vulnerabilities. One involves uncontrolled recursion during XML serialization, and the other affects XML parsing.