Description
Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| qt | qt | 2.2.0 – < 6.8.2 | 6.8.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qt6-base | 6.8.2+dfsg-5 | — |
| Debian 14 | qtbase-opensource-src | No fix yet | — |
| Debian 13 | qt6-base | 6.8.2+dfsg-5 | — |
| Debian 13 | qtbase-opensource-src | No fix yet | — |
| Debian 12 | qt6-base +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qtbase-opensource-src | No fix yet | — |
| Ubuntu 26.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu 24.04 LTS | qt6-base | No fix yet | — |
| Ubuntu 22.04 LTS | qt6-base | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 22.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 20.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 18.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 16.04 LTS | qtbase-opensource-src | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | qt6-qtbase +9 | 6.8.1-9.el10_0.1 | RHSA-2026:84582 |
| Red Hat Hardened Images 1 | qt6-qtbase +10 | 6.11.2-3.hum1 | RHSA-2026:74653 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.2 | ALSA-2026:87082 |
| AlmaLinux 8 | qt5-qtbase +9 | 5.15.3-10.el8_10 | ALSA-2026:93924 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | qt5-qtbase | 5.15.9-11.el9_8.2 | RLSA-2026:87082 |
| Rocky Linux 8 | qt5-qtbase | 5.15.3-10.el8_10 | RLSA-2026:93924 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +9 | 5.15.3-1.amzn2.0.3 | ALAS2-2026-3951 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | qtbase | 6.6.3-6 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.2 | ELSA-2026-87082 |
| Oracle Linux 8 | qt5-qtbase +9 | 5.15.3-10.el8_10 | ELSA-2026-93924 |
Advisories 10
- RHSA-2026:74653 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3227 QT: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:93924 Important: qt5-qtbase security update Rocky Linux Security Advisories · Nov 3, 2026
- ALSA-2026:93924 Important: qt5-qtbase security update AlmaLinux Security Advisories · Nov 3, 2026
- ELSA-2026-93924 Important: qt5-qtbase security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 2, 2026
- ALSA-2026:87082 Important: qt5-qtbase security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:87082 Important: qt5-qtbase security update Rocky Linux Security Advisories · Oct 22, 2026
- ELSA-2026-87082 Important: qt5-qtbase security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
- RHSA-2026:84582 Red Hat Security Advisory: qt6-qtbase security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- ALAS2-2026-3951 Important: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 28, 2026