Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-19248: QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input. CVE-2026-11573: Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | qt5-qtbase | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-common | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-debuginfo | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-devel | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-examples | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-gui | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-mysql | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-odbc | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-postgresql | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-private-devel | 0:5.15.3-1.amzn2.0.3 |
| Amazon Linux · 2 | qt5-qtbase-static | 0:5.15.3-1.amzn2.0.3 |
Vulnerabilities 2
-
High 7.1
Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)
Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no dept…
-
High 7.1
Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.