Red Hat Security Advisory: qt5-qtbase security update

Fixed packages 36

Vulnerabilities 2

• High 7.1
  CVE-2026-11573

  Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

  Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no dept…

  Qt Project Qt qtbase-opensource-src qtbase-opensource-src Debian Ubuntu Azure Linux
  Sep 8, 2026
• High 7.1
  CVE-2026-19248

  Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt

  QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

  Qt Project Qt qtbase-opensource-src qtbase-opensource-src Debian Ubuntu
  Sep 16, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529762
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535011
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96089.json
• report
  https://access.redhat.com/security/cve/CVE-2026-11573
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11573
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11573
• article
  https://codereview.qt-project.org/c/qt/qtbase/+/606899
• report
  https://access.redhat.com/security/cve/CVE-2026-19248
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19248
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19248
• article
  https://codereview.qt-project.org/c/qt/qtbase/+/740427