CVE-2025-5991: Use after free in QHttp2ProtocolHandler

Published Jun 11, 2025

Updated

There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not affected by this at all. This happens due to a race condition between how QHttp2Stream uploads the body of a POST request and the simultaneous handling of HTTP error responses.

This issue only affects Qt 6.9.0 and has been fixed for Qt 6.9.1.

Affected Software

1 affected component

Qt QtNetwork - QHttp2ProtocolHandler=6.9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QtNetwork/QHttp2ProtocolHandler to a version that resolves this vulnerability.
Fixed in 6.9.1

Event History

Jun 11, 2025

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeakness

Oct 30, 57501

Event

via FIRST·02:08 AM

Frequently Asked Questions

What is the severity of CVE-2025-5991?

The severity of CVE-2025-5991 is high due to the potential for an attacker to exploit the use-after-free vulnerability in the QHttp2ProtocolHandler.

How do I fix CVE-2025-5991?

To fix CVE-2025-5991, upgrade to the latest version of the QtNetwork module that contains the security patch for this vulnerability.

What systems are affected by CVE-2025-5991?

CVE-2025-5991 specifically affects systems using QtNetwork for handling HTTP/2 requests.

What is the nature of the vulnerability in CVE-2025-5991?

CVE-2025-5991 is a use-after-free vulnerability caused by a race condition in how the QHttp2Stream processes POST requests.

Can CVE-2025-5991 affect applications using only HTTP?

No, CVE-2025-5991 only affects HTTP/2 handling, and applications utilizing only HTTP are not impacted.