Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-16762: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity -- no data disclosure, data modification, or code execution -- and the impact is contained to the affected process.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | qt5-qtbase | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-common | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-debuginfo | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-devel | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-examples | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-gui | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-mysql | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-odbc | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-postgresql | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-private-devel | 0:5.15.3-1.amzn2.0.5 |
| Amazon Linux · 2 | qt5-qtbase-static | 0:5.15.3-1.amzn2.0.5 |
Vulnerabilities 1
-
High 8.7
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application pars…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-16762.html