Description
Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.
This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.
This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Qt | Qt | 5.0.0 – ≤ 6.5.10, 6.6.0 – ≤ 6.8.5, 6.9.0 – ≤ 6.10.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qt6-declarative | No fix yet | — |
| Debian 14 | qtdeclarative-opensource-src | 5.15.17+dfsg-4 | — |
| Debian 13 | qt6-declarative +2 | No fix yet | — |
| Debian 12 | qt6-declarative +2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qt6-declarative +1 | No fix yet | — |
| Ubuntu 25.10 | qt6-declarative +2 | No fix yet | — |
| Ubuntu 24.04 LTS | qt6-declarative +1 | No fix yet | — |
| Ubuntu 22.04 LTS | qt6-declarative +1 | No fix yet | — |
| Ubuntu 20.04 LTS | qtdeclarative-opensource-src-gles | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | qtdeclarative-opensource-src | No fix yet | — |
| Ubuntu 16.04 LTS | qtdeclarative-opensource-src +1 | No fix yet | — |
| Ubuntu Pro 24.04 LTS | qtdeclarative-opensource-src | 5.15.13+dfsg-1ubuntu0.1+esm1 | USN-8357-1 |
| Ubuntu Pro 22.04 LTS | qtdeclarative-opensource-src | 5.15.3+dfsg-1ubuntu0.1~esm1 | USN-8357-1 |
| Ubuntu Pro 20.04 LTS | qtdeclarative-opensource-src | 5.12.8-0ubuntu1+esm1 | USN-8357-1 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | qt5-qtdeclarative +3 | 5.15.3-3.el8_10 | ALSA-2026:96075 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | qt5-qtdeclarative +3 | 5.15.9-3.el9_9.1 | RLSA-2026:98531 |
| Rocky Linux 8 | qt5-qtdeclarative | 5.15.3-3.el8_10 | RLSA-2026:96075 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +13 | 5.15.3-1.amzn2.0.2 | ALAS2-2025-3102, ALAS2-2025-3101 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | qtdeclarative | 6.6.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | qt5-qtdeclarative | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | qt5-qtdeclarative +3 | 5.15.3-3.el8_10 | ELSA-2026-96075 |
Advisories 8
- RLSA-2026:98531 Important: qt5-qtdeclarative security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2025-2736 QT (Declarative module): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:96075 Important: qt5-qtdeclarative security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96075 Important: qt5-qtdeclarative security update AlmaLinux Security Advisories · Nov 10, 2026
- ELSA-2026-96075 Important: qt5-qtdeclarative security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- USN-8357-1 qtdeclarative-opensource-src vulnerability Ubuntu Security Notices (USN) · Jun 1, 2026
- ALAS2-2025-3101 Important: qt5-qtdeclarative security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 5, 2026
- ALAS2-2025-3102 Important: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 5, 2026