Skip to content
OpenAdvisories
High RLSA-2026:98636 2 CVEs

Important: qt6-qtbase security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Rocky Linux

Summary

Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.

Security Fix(es):

* qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header (CVE-2026-76151)

* qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 69

ReleasePackageFixed in
Rocky Linux · 10 qt6-qtbase 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-common 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debugsource 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debugsource 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debugsource 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-debugsource 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-devel-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-examples-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-gui-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-mysql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-odbc-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-postgresql-debuginfo 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-private-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-private-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-private-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-private-devel 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-static 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-static 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-static 0:6.10.1-1.el10_3.2
Rocky Linux · 10 qt6-qtbase-static 0:6.10.1-1.el10_3.2

Vulnerabilities 2

  • High 8.7
    CVE-2026-16762

    Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

    An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application pars…

    Qt Project Qt qtbase-opensource-src qt6-base Debian Ubuntu Azure Linux
  • Medium 4.6
    CVE-2026-76151

    Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

    Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an exces…

    Qt Project Qt qtbase-opensource-src qt6-base Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535100
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559538
  • advisory
    https://access.redhat.com/errata/RHSA-2026:98636