RLSA-2026:98636: Important: qt6-qtbase security update
Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.
Security Fix(es):
qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header (CVE-2026-76151)
qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/qt6-qtbase-staticto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-develto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-postgresql-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbaseto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-odbcto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-odbc-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-debugsourceto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-postgresqlto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-examples-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-devel-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-gui-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-examplesto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-private-develto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-mysqlto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-guito a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/qt6-qtbase-commonto a version that resolves this vulnerability.Fixed in 0:6.10.1-1.el10_3.2
Event History
Frequently Asked Questions
What kinds of applications are exposed?
Applications using Qt network handling may be exposed to a denial of service from an excessively large HTTP Cache-Control header. Applications that parse attacker-controlled XML with QXmlStreamReader may also be exposed to denial of service.
What does an attacker need to do to exploit these issues?
The HTTP issue requires sending or providing an excessively large Cache-Control header to affected Qt HTTP handling. The XML issue requires crafted XML to be processed by QXmlStreamReader; no privileges or user interaction are indicated by the supplied CVSS vector.
Which Rocky Linux packages are included in this update?
The update lists qt6-qtbase and related static, development, ODBC, PostgreSQL debuginfo, MySQL debuginfo, debugsource, and ODBC debuginfo packages.