RHSA-2026:93924: Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qt5-qtbaseto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-commonto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-debugsourceto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-develto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-devel-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-examplesto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-examples-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-guito a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-gui-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-mysqlto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-odbcto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-odbc-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-postgresqlto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-postgresql-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-private-develto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-tests-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbaseto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-debugsourceto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-develto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-devel-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-examplesto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-examples-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-guito a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-gui-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-mysqlto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-odbcto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-odbc-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-postgresqlto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-postgresql-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-private-develto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-tests-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtbase-staticto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10 - Upgrade
Upgrade
redhat/qt5-qtbase-staticto a version that resolves this vulnerability.Fixed in 5.15.3-10.el8_10.aa
Event History
Frequently Asked Questions
What application behavior is implicated by these issues?
The listed fixes address denial-of-service conditions in Qt XML handling: uncontrolled recursion during XML serialization and a vulnerability during XML parsing.
What could an attacker need to trigger the denial of service?
The advisory identifies XML serialization and parsing as the affected operations, but does not state whether attacker-controlled XML input, local access, authentication, or any particular application configuration is required.
Can this advisory confirm whether a default installation is vulnerable?
No. The provided information identifies qt5-base and Qt base components but does not specify affected package versions, default configurations, or which applications expose the vulnerable XML operations.