CVE-2026-11573: Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)
Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.
Other sources
Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.3-6 - Compensating control
Apply a practical limit on how deeply nested XML is accepted/processed before serializing with Qt (e.g., reject or truncate documents whose element nesting depth exceeds a configured threshold), since the Qt QDomDocument/QDomNode serialization path can recurse without a depth limit and exhaust the call stack.
Event History
Frequently Asked Questions
What applications are exposed to this issue?
Applications that use QtXml's QDomDocument to parse and serialize untrusted XML are exposed if an attacker can supply deeply nested XML. The reported impact is an application crash through stack exhaustion.
What must an attacker provide to trigger the crash?
The attacker needs to cause the application to process deeply nested untrusted XML and serialize the resulting QDomDocument with toByteArray(). The issue is denial of service only.
How can I determine whether an application may be affected?
Review whether the application accepts XML from untrusted sources, uses QDomDocument from QtXml to parse it, and calls QDomDocument::toByteArray() on the parsed document. Deeply nested XML in that processing path is the relevant condition.