UBUNTU-CVE-2026-96432: Null Pointer Dereference

Published Oct 26, 2026

Updated

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Affected Software

4 affected components

ubuntu/qt6-base*

Event History

Oct 26, 2026

CVE Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using QNetworkAccessManager in the Qt Network module are exposed when they connect to a malicious or compromised HTTP/2 server. The affected software identified here is ubuntu/qt6-base.

What does an attacker need to trigger the failure?

The attacker needs control of, or the ability to compromise, an HTTP/2 server that the application contacts. The server must withhold a SETTINGS acknowledgement and send protocol messages in the required sequence for a completed stream.

What is the expected security impact?

The stated impact is an application crash caused by a null pointer dereference. The supplied vector indicates high availability impact and no confidentiality or integrity impact.

UBUNTU-CVE-2026-96432: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the failure?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the failure?

What is the expected security impact?