OESA-2026-4743: qt5-qtbase security update

Q: Which applications are exposed to this issue?

Applications using QtXml's QDomDocument serialization on deeply nested XML from untrusted sources are exposed. The impact described is denial of service through stack exhaustion, causing the application to crash.

Q: What does an attacker need to exploit it?

An attacker needs to cause the affected application to process deeply nested, untrusted XML through QDomDocument serialization. No authentication or special privileges are indicated, but user interaction is required by the supplied severity vector.

Q: What can be done if the update cannot be applied immediately?

Avoid serializing untrusted XML with QDomDocument, or reject XML documents with excessive nesting before they reach the affected serialization path. This reduces the opportunity for stack exhaustion.

Published Nov 11, 2026

Updated

This package provides base tools, such as string, xml, and network handling. Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Affected Software

1 affected componentFixes available

openeuler/qt5-qtbase<5.15.2-22.oe2203sp4

5.15.2-22.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/qt5-qtbase to a version that resolves this vulnerability.
Fixed in 5.15.2-22.oe2203sp4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-11573

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using QtXml's QDomDocument serialization on deeply nested XML from untrusted sources are exposed. The impact described is denial of service through stack exhaustion, causing the application to crash.

What does an attacker need to exploit it?

An attacker needs to cause the affected application to process deeply nested, untrusted XML through QDomDocument serialization. No authentication or special privileges are indicated, but user interaction is required by the supplied severity vector.

What can be done if the update cannot be applied immediately?

Avoid serializing untrusted XML with QDomDocument, or reject XML documents with excessive nesting before they reach the affected serialization path. This reduces the opportunity for stack exhaustion.

OESA-2026-4743: qt5-qtbase security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What can be done if the update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What can be done if the update cannot be applied immediately?