CVE-2026-16762
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
CVE-2026-16762 is a high vulnerability (CVSS 8.7) in Qt, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in qt5-qtbase-common 5.15.3-11.el8_10.
- Severity
- 8.7 HighCVSS 4.0, CVE List
- Exploit chance
- 0.52%EPSS, 44th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.15.3-11.el8_10qt5-qtbase-common +179 more
Description
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt5-qtbase-commonAlmaLinux:8 | before 5.15.3-11.el8_10 | 5.15.3-11.el8_10 |
qtbaseAzure Linux:3 | through 6.6.3-7 | None known |
qt6-baseDebian:12 | All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 45 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-36.6.1+dfsg-4 | None known |
qt6-baseDebian:13 | All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 34 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.8.2+dfsg-9+deb13u16.8.2+dfsg-9+deb13u26.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 | None known |
qt6-baseDebian:14 | before 6.11.2+dfsg-5, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 29 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 | 6.11.2+dfsg-5 |
qtbase-opensource-srcDebian:12 | All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 45 moreShow less5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-25.15.9+dfsg-3 | None known |
qtbase-opensource-srcDebian:13 | All versions, plus listed versions 5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1 Show 14 moreShow less5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-5 | None known |
qtbase-opensource-srcDebian:14 | All versions, plus listed versions 5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2 Show 13 moreShow less5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-5 | None known |
qtbase-opensource-src-glesDebian:12 | All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 13 moreShow less5.15.10+dfsg-65.15.12+dfsg-15.15.13+dfsg-15.15.13+dfsg-25.15.15+dfsg-15.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-35.15.9+dfsg-1 | None known |
qtbase-opensource-src-glesDebian:13 | All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2 | None known |
Show 170 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtbase-opensource-src-glesDebian:14 | All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2 | None known |
qt6Red Hat:hummingbird:1 From an advisory covering 2 CVEs | before 0:6.11.2-1.1.hum1 | 0:6.11.2-1.1.hum1 |
qt6-filesystemRed Hat:hummingbird:1 From an advisory covering 2 CVEs | before 0:6.11.2-1.1.hum1 | 0:6.11.2-1.1.hum1 |
qt6-rpm-macrosRed Hat:hummingbird:1 From an advisory covering 2 CVEs | before 0:6.11.2-1.1.hum1 | 0:6.11.2-1.1.hum1 |
qt6-srpm-macrosRed Hat:hummingbird:1 From an advisory covering 2 CVEs | before 0:6.11.2-1.1.hum1 | 0:6.11.2-1.1.hum1 |
qt5-qtbaseRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-commonRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-debugsourceRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-develRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-devel-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-examplesRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-examples-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-guiRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-gui-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-mysqlRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-mysql-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-odbcRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-odbc-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-postgresqlRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-postgresql-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-private-develRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-tests-debuginfoRed Hat:enterprise_linux:8::appstream | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-debugsourceRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-devel-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-examples-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-gui-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-mysql-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-odbc-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-postgresql-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-staticRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbase-tests-debuginfoRed Hat:enterprise_linux:8::crb | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbaseRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-commonRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-debugsourceRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-develRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-devel-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-examplesRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-examples-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-guiRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-gui-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-mysqlRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-mysql-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-odbcRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-odbc-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-postgresqlRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-postgresql-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-private-develRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-tests-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-debugsourceRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-devel-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-examples-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-gui-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-mysql-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-odbc-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-postgresql-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-staticRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-tests-debuginfoRed Hat:enterprise_linux:9::crb | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt6-qtbaseRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-commonRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-debugsourceRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-develRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-devel-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-examples-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-guiRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-gui-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-mysqlRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-mysql-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-odbcRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-odbc-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-postgresqlRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-postgresql-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-tests-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-examplesRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-private-develRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-staticRed Hat:enterprise_linux:10.3 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt5-qtbaseRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-commonRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-debugsourceRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-develRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-devel-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-examplesRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-examples-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-guiRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-gui-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-mysqlRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-mysql-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-odbcRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-odbc-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-postgresqlRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-postgresql-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-private-develRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-tests-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-debugsourceRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-devel-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-examples-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-gui-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-mysql-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-odbc-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-postgresql-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-staticRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt5-qtbase-tests-debuginfoRed Hat:rhel_eus:9.8::crb | before 0:5.15.9-11.el9_8.3 | 0:5.15.9-11.el9_8.3 |
qt6-qtbaseRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-commonRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-debugsourceRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-develRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-devel-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-examples-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-guiRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-gui-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-mysqlRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-mysql-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-odbcRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-odbc-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-postgresqlRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-postgresql-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-tests-debuginfoRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-examplesRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-private-develRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt6-qtbase-staticRed Hat:enterprise_linux_eus:10.2 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_2.2 | 0:6.10.1-1.el10_2.2 |
qt5-qtbaseRocky Linux:8 | before 0:5.15.3-11.el8_10 | 0:5.15.3-11.el8_10 |
qt5-qtbaseRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-debugsourceRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-develRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-devel-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-examplesRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-examples-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-guiRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-gui-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-mysqlRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-mysql-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-odbcRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-odbc-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-postgresqlRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-postgresql-debuginfoRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-private-develRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-staticRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt5-qtbase-commonRocky Linux:9 | before 0:5.15.9-12.el9_9.2 | 0:5.15.9-12.el9_9.2 |
qt6-qtbase-staticRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-develRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-postgresql-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbaseRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-odbcRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-mysql-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-odbc-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-debugsourceRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-postgresqlRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-examples-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-devel-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-gui-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-examplesRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-private-develRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-mysqlRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-debuginfoRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-guiRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qt6-qtbase-commonRocky Linux:10 From an advisory covering 2 CVEs | before 0:6.10.1-1.el10_3.2 | 0:6.10.1-1.el10_3.2 |
qtbase-opensource-src-glesUbuntu:16.04:LTS | All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 9 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6 | None known |
qtbase-opensource-src-glesUbuntu:20.04:LTS | All versions, plus listed versions 5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1 | None known |
qtbase-opensource-src-glesUbuntu:22.04:LTS | All versions, plus listed versions 5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1 | None known |
qtbase-opensource-src-glesUbuntu:24.04:LTS | All versions, plus listed versions 5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1 | None known |
qtbase-opensource-src-glesUbuntu:26.10 | All versions, plus listed versions 5.15.18+dfsg-15.15.19+dfsg-2 | None known |
qtbase-opensource-src-glesUbuntu:26.04:LTS | All versions, plus listed versions 5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1 | None known |
What each source reports
CVE List Score used
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
CVE-2026-16762- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L - Weakness
- CWE-407
- Updated
- 2026-11-02
EUVDEUVD-2026-108655
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
EUVD-2026-108655- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3gxv-qxph-7hg3
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can...
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
GHSA-3gxv-qxph-7hg3- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X - Weakness
- CWE-407
- Updated
- 2026-11-02
NVD
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
CVE-2026-16762- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X - Weakness
- CWE-407
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-16762
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
DEBIAN-CVE-2026-16762- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X - Updated
- 2026-11-02
OSVRHSA-2026:80569
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:80569- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-13
Show 11 moreShow less
OSVRHSA-2026:98103
Red Hat Security Advisory: qt5-qtbase security update
- Record
RHSA-2026:98103- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98535
Red Hat Security Advisory: qt5-qtbase security update
- Record
RHSA-2026:98535- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98636
Red Hat Security Advisory: qt6-qtbase security update
- Record
RHSA-2026:98636- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99149
Red Hat Security Advisory: qt5-qtbase security update
- Record
RHSA-2026:99149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99155
Red Hat Security Advisory: qt6-qtbase security update
- Record
RHSA-2026:99155- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:98103
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
- qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:98103- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
OSVRLSA-2026:98535
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
- qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:98535- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:98636
Important: qt6-qtbase security update
Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.
Security Fix(es):
qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header (CVE-2026-76151)
qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:98636- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-16762
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
UBUNTU-CVE-2026-16762- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L - Updated
- 2026-11-02
OSVALSA-2026:98103No score
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
- qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:98103- Updated
- 2026-11-13
OSVAZL-111425No score
CVE-2026-16762 affecting package qtbase 6.6.3-7
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
- Record
AZL-111425- Updated
- 2026-11-05
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products
codereview.qt-project.org/c/qt/qtbase/+/738885
nvd.nist.gov/vuln/detail/CVE-2026-16762
github.com/advisories/GHSA-3gxv-qxph-7hg3
access.redhat.com/errata/RHSA-2026:98103
Show 36 moreShow less
errata.almalinux.org/8/ALSA-2026-98103.html
security-tracker.debian.org/tracker/CVE-2026-16762
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80569.json
bugzilla.redhat.com/show_bug.cgi?id=2559538
cve.org/CVERecord?id=CVE-2026-16762
errata.rockylinux.org/RLSA-2026:98103
ubuntu.com/security/CVE-2026-16762
advisory.echohq.com/cve/cve-2026-16762
Left out here: 42 versions. The JSON record has them.