Description
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| qt | qt | 4.3.0 – < 6.8.9, 6.9.0 – < 6.11.2 | 6.8.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qt6-base | 6.11.2+dfsg-5 | — |
| Debian 14 | qtbase-opensource-src +1 | No fix yet | — |
| Debian 13 | qt6-base +2 | No fix yet | — |
| Debian 12 | qt6-base +2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 26.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 24.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 22.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 20.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | qt5-qtbase-common | 5.15.3-11.el8_10 | ALSA-2026:98103 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | qt6-qtbase +9 | 6.10.1-1.el10_3.2 | RLSA-2026:98636 |
| Rocky Linux 9 | qt5-qtbase +9 | 5.15.9-12.el9_9.2 | RLSA-2026:98535 |
| Rocky Linux 8 | qt5-qtbase | 5.15.3-11.el8_10 | RLSA-2026:98103 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +9 | 5.15.3-1.amzn2.0.5 | ALAS2-2026-4060 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | qtbase | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | qt5-qtbase +9 | 5.15.3-11.el8_10 | ELSA-2026-98103 |
Advisories 7
- RLSA-2026:98535 Important: qt5-qtbase security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98636 Important: qt6-qtbase security update Rocky Linux Security Advisories · Nov 13, 2026
- ALSA-2026:98103 Important: qt5-qtbase security update AlmaLinux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4122 Qt Core QXmlStream parser: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:98103 Important: qt5-qtbase security update Rocky Linux Security Advisories · Nov 12, 2026
- ELSA-2026-98103 Important: qt5-qtbase security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 12, 2026
- ALAS2-2026-4060 Important: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 2, 2026