RLSA-2026:93924: Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/qt5-qtbaseto a version that resolves this vulnerability.Fixed in 0:5.15.3-10.el8_10
Event History
Frequently Asked Questions
Which systems are exposed to these issues?
Systems running Rocky Linux qt5-qtbase packages are covered by this security update. The advisory also identifies related qt6-qtbase and qtbase components for the listed CVEs, but it does not provide affected version ranges or configuration details.
What can an attacker do if the vulnerabilities are exploited?
Both listed CVEs can cause denial of service. One involves uncontrolled recursion during XML serialization, and the other affects XML parsing; the provided severity vector indicates network-reachable exploitation with low complexity and no required privileges or user interaction.
How can I determine whether my system is affected?
Check whether qt5-qtbase is installed on the Rocky Linux system and compare its installed package state with the security update referenced by RLSA-2026:93924. The supplied advisory data does not include the fixed package version.