{"id":"CVE-2018-21035","aliases":["ALSA-2020:4690","AZL-6833","DEBIAN-CVE-2018-21035","EUVD-2018-13555","GHSA-xhq4-5269-2ffv","MGASA-2021-0270","RHSA-2020:4690","RLSA-2020:4690","UBUNTU-CVE-2018-21035"],"status":"published","title":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for...","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","severity":{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.02339,"percentile":0.83702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2020-02-28T19:17:43Z","modified":"2026-10-29T11:00:18Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qt5-qtsvg","fixed_in":["5.12.11-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qtwebsockets-opensource-src","fixed_in":["5.15.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtwebsockets-opensource-src","fixed_in":["5.15.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtwebsockets-opensource-src","fixed_in":["5.15.1-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"qtwebsockets5","fixed_in":["5.12.6-1.1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qttools-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:2","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.11-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.1-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"qtwebsockets5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.6-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-assistant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-assistant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-designer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-designer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-doctools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-doctools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-linguist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-linguist-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qdbusviewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qdbusviewer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-gui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-libs-designer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-libs-designer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-libs-designercomponents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-libs-designercomponents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-libs-help","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-libs-help-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qttools-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtwebsockets-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-assistant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-designer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-doctools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-linguist-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qdbusviewer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-gui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-6.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-libs-designer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-libs-designercomponents-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-libs-help-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qttools-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"qt5-qtwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.12.5-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2-2build1","5.5.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1-3","5.9.2-3build1","5.9.3-0ubuntu1","5.9.4-0ubuntu1","5.9.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4-1","5.12.5-2","5.12.5-2build1","5.12.8-0ubuntu1"]}],"products":[{"vendor":"qt","product":"qt"}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugreports.qt.io/browse/QTBUG-70693","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-21035","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xhq4-5269-2ffv"},{"url":"https://vulners.com/cve/CVE-2015-9541","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2018-21035","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-0569","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-0570","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-13962","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-21035","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0270.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27560","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4690","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800600","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1849734","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4690.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-9541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-9541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-9541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-21035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-21035","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-0569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-0569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0569","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-0570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-0570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0570","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13962","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4690","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-21035","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-21035","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T19:17:43Z","modified":"2024-08-05T12:19:27.472Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:02.289647Z"}],"euvd":[{"id":"EUVD-2018-13555","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T19:17:43Z","modified":"2024-08-05T12:19:27Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N","level":"high"}],"updated_at":"2026-11-03T02:39:28.765449Z"}],"ghsa":[{"id":"GHSA-xhq4-5269-2ffv","title":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for...","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2022-05-24T17:09:52Z","modified":"2023-01-29T05:01:35Z","updated_at":"2026-11-02T14:44:51.691892Z"}],"nvd":[{"id":"CVE-2018-21035","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T21:15:12.79Z","modified":"2026-06-17T01:54:00.237Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:05:00.03074Z"}],"osv":[{"id":"AZL-6833","title":"CVE-2018-21035 affecting package qt5-qtsvg for versions less than 5.12.11-3","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T21:15:12Z","modified":"2026-04-21T04:38:23.315285Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2018-21035","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T21:15:12.79Z","modified":"2026-10-24T10:30:53.478888784Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-21035","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T21:15:12.79Z","modified":"2026-10-23T18:03:05.823535329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"RHSA-2020:4690","title":"Red Hat Security Advisory: qt5-qtbase and qt5-qtwebsockets security and bug fix update","status":"published","published":"2024-09-16T04:13:23Z","modified":"2026-10-09T10:02:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4690","title":"Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update","description":"Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. \n\nSecurity Fix(es):\n\n* qt: XML entity expansion vulnerability (CVE-2015-9541)\n\n* qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS (CVE-2018-21035)\n\n* qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0569)\n\n* qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0570)\n\n* qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:27:18Z","modified":"2026-02-05T06:45:12.581121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2018-21035","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).","status":"published","published":"2020-02-28T21:15:00Z","modified":"2026-04-22T11:53:28.545963Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"ALSA-2020:4690","title":"Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update","description":"Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. \n\nSecurity Fix(es):\n\n* qt: XML entity expansion vulnerability (CVE-2015-9541)\n\n* qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS (CVE-2018-21035)\n\n* qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0569)\n\n* qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0570)\n\n* qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:27:18Z","modified":"2026-10-29T11:00:18.039289287Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2021-0270","title":"Updated qtwebsockets5 packages fix a security vulnerability","description":"In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for \nframes and 2GB for messages. Smaller limits cannot be configured. This makes \nit easier for attackers to cause a denial of service (memory consumption)\n(CVE-2018-21035).\n","status":"published","published":"2021-06-23T17:11:28Z","modified":"2026-04-16T04:41:55.876758932Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}