High RHSA-2026:99746 2 CVEs

Red Hat Security Advisory: qt5-qtbase security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 12

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-common	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-debuginfo	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-devel	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-doc	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-examples	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-gui	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-mysql	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-odbc	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-postgresql	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-qtbase-static	0:5.9.7-6.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	qt5-rpm-macros	0:5.9.7-6.el7_9.1

Vulnerabilities 2

High 7.1

CVE-2026-11573

Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no dept…

Qt Project Qt qtbase-opensource-src qtbase-opensource-src Debian Ubuntu Azure Linux

Sep 8, 2026
High 7.1

CVE-2026-19248

Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

Qt Project Qt qtbase-opensource-src qtbase-opensource-src Debian Ubuntu

Sep 16, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2529762
report
https://bugzilla.redhat.com/show_bug.cgi?id=2535011
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99746.json
report
https://access.redhat.com/security/cve/CVE-2026-11573
advisory
https://www.cve.org/CVERecord?id=CVE-2026-11573
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-11573
article
https://codereview.qt-project.org/c/qt/qtbase/+/606899
report
https://access.redhat.com/security/cve/CVE-2026-19248
advisory
https://www.cve.org/CVERecord?id=CVE-2026-19248
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-19248
article
https://codereview.qt-project.org/c/qt/qtbase/+/740427