Description
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| qt | qt | 2.2.0 – ≤ 6.8.8, 6.9.0 – ≤ 6.11.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qt6-base | 6.11.2+dfsg-5 | — |
| Debian 14 | qtbase-opensource-src | 5.15.19+dfsg-5 | — |
| Debian 13 | qt6-base +1 | No fix yet | — |
| Debian 12 | qt6-base +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qt6-base +1 | No fix yet | — |
| Ubuntu 26.04 LTS | qt6-base +1 | No fix yet | — |
| Ubuntu 24.04 LTS | qt6-base | No fix yet | — |
| Ubuntu 22.04 LTS | qt6-base | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 22.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 20.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 18.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 16.04 LTS | qtbase-opensource-src | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | qt6-qtbase +9 | 6.10.1-1.el10_3.1 | RHSA-2026:98618 |
| RHEL 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.2 | RHSA-2026:98507, RHSA-2026:87082 |
| RHEL 8 | qt5-qtbase +9 | 5.15.3-10.el8_10 | RHSA-2026:93924 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.2 EUS | qt6-qtbase +9 | 6.10.1-1.el10_2.1 | RHSA-2026:99094 |
| RHEL 9.6 EUS | qt5-qtbase +9 | 5.15.9-11.el9_6.2 | RHSA-2026:95575 |
| RHEL 9.4 E4S | qt5-qtbase +8 | 5.15.9-11.el9_4.2 | RHSA-2026:95588 |
| RHEL 9.2 E4S | qt5-qtbase +8 | 5.15.3-2.el9_2.3 | RHSA-2026:95574 |
| RHEL 8.8 TUS | qt5-qtbase +8 | 5.15.3-2.el8_8.2 | RHSA-2026:96089 |
| RHEL 8.8 E4S | qt5-qtbase +8 | 5.15.3-2.el8_8.2 | RHSA-2026:96089 |
| RHEL 8.6 EUS Long Life | qt5-qtbase +8 | 5.15.2-5.el8_6.2 | RHSA-2026:95619 |
| RHEL 8.6 AUS | qt5-qtbase +8 | 5.15.2-5.el8_6.2 | RHSA-2026:95619 |
| RHEL 8.4 EUS Long Life | qt5-qtbase +8 | 5.12.5-9.el8_4.3 | RHSA-2026:96086 |
| RHEL 8.4 AUS | qt5-qtbase +8 | 5.12.5-9.el8_4.3 | RHSA-2026:96086 |
| RHEL 7 ELS | qt5-qtbase +10 | 5.9.7-6.el7_9.1 | RHSA-2026:99746 |
| Red Hat Hardened Images 1 | qt5-qtbase +11 | 5.15.18-5.2.hum1 | RHSA-2026:68801 |
| Red Hat Hardened Images 1 | qt6-qtbase +10 | 6.11.2-2.hum1 | RHSA-2026:59393 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.2 | ALSA-2026:87082 |
| AlmaLinux 8 | qt5-qtbase +9 | 5.15.3-10.el8_10 | ALSA-2026:93924 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | qt5-qtbase | 5.15.9-11.el9_8.2 | RLSA-2026:87082 |
| Rocky Linux 8 | qt5-qtbase | 5.15.3-10.el8_10 | RLSA-2026:93924 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +9 | 5.15.3-1.amzn2.0.3 | ALAS2-2026-3951 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.2 | ELSA-2026-87082 |
| Oracle Linux 8 | qt5-qtbase +9 | 5.15.3-10.el8_10 | ELSA-2026-93924 |
Advisories 22
- RHSA-2026:99746 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99094 Red Hat Security Advisory: qt6-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98618 Red Hat Security Advisory: qt6-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98507 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96086 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95575 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95619 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95588 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95574 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96089 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93924 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87082 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3332 QT: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:93924 Important: qt5-qtbase security update Rocky Linux Security Advisories · Nov 3, 2026
- ALSA-2026:93924 Important: qt5-qtbase security update AlmaLinux Security Advisories · Nov 3, 2026
- ELSA-2026-93924 Important: qt5-qtbase security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 2, 2026
- ALSA-2026:87082 Important: qt5-qtbase security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:87082 Important: qt5-qtbase security update Rocky Linux Security Advisories · Oct 22, 2026
- ELSA-2026-87082 Important: qt5-qtbase security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
- ALAS2-2026-3951 Important: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- RHSA-2026:59393 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:68801 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
References
- dev patch patch