Summary
[5.15.3-10]
- Fix CVE-2026-19248: unbounded recursion and O(N2) behavior in QDom
Resolves: RHEL-261130
- Fix CVE-2026-11573: denial of services via uncontrolled recursion in
XML serialization
Resolves: RHEL-277662
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | qt5-qtbase | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-common | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-devel | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-examples | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-gui | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-mysql | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-odbc | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-postgresql | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-private-devel | 0:5.15.3-10.el8_10 |
| Oracle Linux · 8 | qt5-qtbase-static | 0:5.15.3-10.el8_10 |
Vulnerabilities 2
-
High 7.1
Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)
Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no dept…
-
High 7.1
Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.