Every CVESearch/Get API key

CVE-2026-114366

Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework

2.3 LowFix available

CVE-2026-114366 is a low vulnerability (CVSS 2.3) in Qt Framework, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in qt6-websockets 6.12.0-2.1.

What does this mean?
Severity
2.3 LowCVSS 4.0, CVE List
Exploit chance
0.39%EPSS, 33rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
6.12.0-2.1qt6-websockets +17 more

Description

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.39%Unchanged since Nov 6, 2026
90%50%10%1%

Discussion

Quiet in the last day.
14 days ago: 0 people13 days ago: 0 people12 days ago: 0 people11 days ago: 0 people10 days ago: 0 people9 days ago: 0 people8 days ago: 0 people7 days ago: 1 person6 days ago: 0 people5 days ago: 0 people4 days ago: 0 people3 days ago: 0 people2 days ago: 0 people1 day ago: 0 peopleLast 24 hours: 0 people

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt6-websockets
Debian:12
All versions, plus listed versions
6.10.2-16.10.2-26.10.2-36.11.2-16.11.2-2
Show 20 moreShow less
6.4.2-16.4.2-26.4.2-36.6.0-16.6.0-26.6.1-16.6.2-16.6.2-26.7.2-16.7.2-26.7.2-36.7.2-46.8.2-16.8.2-26.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-3
None known
qt6-websockets
Debian:13
All versions, plus listed versions
6.10.2-16.10.2-26.10.2-36.11.2-16.11.2-2
Show 6 moreShow less
6.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-3
None known
qt6-websockets
Debian:14
All versions, plus listed versions
6.10.2-16.10.2-26.10.2-36.11.2-16.11.2-2
Show 6 moreShow less
6.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-3
None known
qtwebsockets-opensource-src
Debian:12
All versions, plus listed versions
5.15.10-15.15.10-25.15.12-15.15.13-15.15.13-2
Show 11 moreShow less
5.15.13-2+loong645.15.15-15.15.15-25.15.17-15.15.17-25.15.17-35.15.18-15.15.19-15.15.19-25.15.8-25.15.9-1
None known
qtwebsockets-opensource-src
Debian:13
All versions, plus listed versions
5.15.15-25.15.17-15.15.17-25.15.17-35.15.18-15.15.19-15.15.19-2
None known
qtwebsockets-opensource-src
Debian:14
All versions, plus listed versions
5.15.15-25.15.17-15.15.17-25.15.17-35.15.18-15.15.19-15.15.19-2
None known
qtwebsockets-opensource-src
Ubuntu:16.04:LTS
All versions, plus listed versions
5.4.2-2build15.5.1-4build1
None known
qtwebsockets-opensource-src
Ubuntu:18.04:LTS
All versions, plus listed versions
5.9.1-35.9.2-3build15.9.3-0ubuntu15.9.4-0ubuntu15.9.5-0ubuntu1
None known
qtwebsockets-opensource-src
Ubuntu:20.04:LTS
All versions, plus listed versions
5.12.4-15.12.5-25.12.5-2build15.12.8-0ubuntu1
None known
qt6-websockets
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.2-36.2.4-1
None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
qtwebsockets-opensource-src
Ubuntu:22.04:LTS
All versions, plus listed versions
5.15.2-25.15.3-1
None known
qt6-websockets
Ubuntu:24.04:LTS
All versions, plus listed versions
6.4.2-36.4.2-3build16.4.2-3build2
None known
qtwebsockets-opensource-src
Ubuntu:24.04:LTS
All versions, plus listed versions
5.15.10-25.15.12-15.15.12-1build15.15.12-1build25.15.13-1
None known
qt6-websockets
Ubuntu:26.10
All versions, plus listed versions
6.10.2-16.10.2-36.11.2-1
None known
qtwebsockets-opensource-src
Ubuntu:26.10
All versions, plus listed versions
5.15.18-15.15.19-2
None known
qt6-websockets
Ubuntu:26.04:LTS
All versions, plus listed versions
6.9.2-16.9.2-36.10.2-1
None known
qtwebsockets-opensource-src
Ubuntu:26.04:LTS
All versions, plus listed versions
5.15.17-25.15.17-35.15.18-1
None known
qt6-websockets
openSUSE:Tumbleweed
before 6.12.0-2.1
6.12.0-2.1

What each source reports

CVE List Score used2.3

Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Record
CVE-2026-114366
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green
Weakness
CWE-226
Updated
2026-11-10
EUVDEUVD-2026-1178892.3

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Record
EUVD-2026-117889
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green
Updated
2026-11-10
GitHub AdvisoriesGHSA-gx9x-355g-wxcm2.3

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of...

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Record
GHSA-gx9x-355g-wxcm
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green
Weakness
CWE-226
Updated
2026-11-06
NVD2.3

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Record
CVE-2026-114366
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green
Weakness
CWE-226
Updated
2026-11-07
OSVDEBIAN-CVE-2026-1143662.3

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Record
DEBIAN-CVE-2026-114366
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green
Updated
2026-11-07
OSVUBUNTU-CVE-2026-1143662.3

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

Record
UBUNTU-CVE-2026-114366
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green
Updated
2026-11-07
OSVopenSUSE-SU-2026:12492-1No score

libQt6WebSockets6-6.12.0-2.1 on GA media

These are all security issues fixed in the libQt6WebSockets6-6.12.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12492-1
Updated
2026-11-09

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
affected, aliases, published, referencesNVD, OSV
publishedEUVD
publishedEUVD, NVD
aliases, referencesGitHub Advisories
aliases, publishedEUVD
first indexedCVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open