RHSA-2026:99746: Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qt5-qtbaseto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-commonto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-debuginfoto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-develto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-docto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-examplesto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-guito a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-mysqlto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-odbcto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-postgresqlto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-qtbase-staticto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1 - Upgrade
Upgrade
redhat/qt5-rpm-macrosto a version that resolves this vulnerability.Fixed in 5.9.7-6.el7_9.1
Event History
Frequently Asked Questions
Which issues are addressed by this update?
The update addresses CVE-2026-11573, a denial-of-service issue caused by uncontrolled recursion during XML serialization, and CVE-2026-19248, a denial-of-service issue in XML parsing.
Which packages are included in the update?
The advisory lists qt5-qtbase and related packages: qt5-qtbase-debuginfo, qt5-qtbase-devel, qt5-qtbase-doc, qt5-qtbase-examples, qt5-qtbase-gui, qt5-qtbase-mysql, and qt5-qtbase-odbc.