OESA-2026-4722: qt6-qtbase security update
Qt is a software toolkit for developing applications. Security Fix(es):
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/qt6-qtbaseto a version that resolves this vulnerability.Fixed in 6.5.2-18.oe2403sp4
Event History
Frequently Asked Questions
Which applications are exposed to the QtNetwork issue?
Applications using QNetworkAccessManager on affected non-32-bit Qt builds are exposed when they connect to an untrusted or compromised HTTP server that returns an excessively large Cache-Control header. Only the client side of the HTTP connection is affected.
What impact can the HTTP Cache-Control parsing flaw have?
A remote attacker can cause the affected application to crash, resulting in denial of service. The out-of-bounds access is read-only; the provided information states there is no information disclosure or code execution.
Does the HTTP Cache-Control issue affect 32-bit builds?
No. The advisory states that 32-bit builds are not affected.
What input is relevant to the XML parsing issue?
The QDomDocument issue is triggered when processing untrusted XML input and can cause a remotely triggered denial-of-service crash.