{"id":"CVE-2026-114366","aliases":["DEBIAN-CVE-2026-114366","EUVD-2026-117889","GHSA-gx9x-355g-wxcm","UBUNTU-CVE-2026-114366","openSUSE-SU-2026:12492-1"],"status":"published","title":"Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00386,"percentile":0.32996,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-226"],"published":"2026-11-06T00:00:00Z","modified":"2026-11-09T13:30:04Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"qt6-websockets","fixed_in":["6.12.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1","6.10.2-2","6.10.2-3","6.11.2-1","6.11.2-2","6.4.2-1","6.4.2-2","6.4.2-3","6.6.0-1","6.6.0-2","6.6.1-1","6.6.2-1","6.6.2-2","6.7.2-1","6.7.2-2","6.7.2-3","6.7.2-4","6.8.2-1","6.8.2-2","6.8.2-3","6.9.1-1","6.9.1-2","6.9.2-1","6.9.2-2","6.9.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1","6.10.2-2","6.10.2-3","6.11.2-1","6.11.2-2","6.8.2-3","6.9.1-1","6.9.1-2","6.9.2-1","6.9.2-2","6.9.2-3"]},{"source":"osv","ecosystem":"Debian:14","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1","6.10.2-2","6.10.2-3","6.11.2-1","6.11.2-2","6.8.2-3","6.9.1-1","6.9.1-2","6.9.2-1","6.9.2-2","6.9.2-3"]},{"source":"osv","ecosystem":"Debian:12","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10-1","5.15.10-2","5.15.12-1","5.15.13-1","5.15.13-2","5.15.13-2+loong64","5.15.15-1","5.15.15-2","5.15.17-1","5.15.17-2","5.15.17-3","5.15.18-1","5.15.19-1","5.15.19-2","5.15.8-2","5.15.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15-2","5.15.17-1","5.15.17-2","5.15.17-3","5.15.18-1","5.15.19-1","5.15.19-2"]},{"source":"osv","ecosystem":"Debian:14","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15-2","5.15.17-1","5.15.17-2","5.15.17-3","5.15.18-1","5.15.19-1","5.15.19-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2-2build1","5.5.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1-3","5.9.2-3build1","5.9.3-0ubuntu1","5.9.4-0ubuntu1","5.9.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4-1","5.12.5-2","5.12.5-2build1","5.12.8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-3","6.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.2-2","5.15.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.4.2-3build1","6.4.2-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10-2","5.15.12-1","5.15.12-1build1","5.15.12-1build2","5.15.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1","6.10.2-3","6.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18-1","5.15.19-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1","6.9.2-3","6.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qtwebsockets-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.17-2","5.15.17-3","5.15.18-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qt6-websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-2.1"}]}]}],"products":[{"vendor":"qt","product":"qt framework"}],"references":[{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-114366","tags":["vendor-advisory","report"]},{"url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772273","tags":["patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114366"},{"url":"https://github.com/advisories/GHSA-gx9x-355g-wxcm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-114366","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-114366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114366","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-114366","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-114366","title":"Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","status":"published","published":"2026-11-06T04:40:04.282Z","modified":"2026-11-06T04:40:04.282Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green","level":"low","assessor":"cna"}],"cwes":["CWE-226"],"updated_at":"2026-11-06T05:26:53.987177Z"}],"euvd":[{"id":"EUVD-2026-117889","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","status":"published","published":"2026-11-06T04:40:04Z","modified":"2026-11-06T04:40:04Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green","level":"low"}],"updated_at":"2026-11-06T09:04:28.90285Z"}],"ghsa":[{"id":"GHSA-gx9x-355g-wxcm","title":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of...","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","status":"published","published":"2026-11-06T06:30:21Z","modified":"2026-11-06T06:30:29Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green","level":"low"}],"cwes":["CWE-226"],"updated_at":"2026-11-06T06:59:04.098776Z"}],"nvd":[{"id":"CVE-2026-114366","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","status":"published","published":"2026-11-06T05:18:20.22Z","modified":"2026-11-06T21:13:01.193Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green","level":"low","assessor":"secondary"}],"cwes":["CWE-226"],"updated_at":"2026-11-07T00:02:36.552517Z"}],"osv":[{"id":"DEBIAN-CVE-2026-114366","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","status":"published","published":"2026-11-06T05:18:20.22Z","modified":"2026-11-07T19:00:40.645447065Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green","level":"low"}],"updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"UBUNTU-CVE-2026-114366","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:45:04.594421231Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green","level":"low"}],"updated_at":"2026-11-07T01:57:16.198641Z"},{"id":"openSUSE-SU-2026:12492-1","title":"libQt6WebSockets6-6.12.0-2.1 on GA media","description":"These are all security issues fixed in the libQt6WebSockets6-6.12.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-08T00:00:00Z","modified":"2026-11-09T13:30:04.220797948Z","updated_at":"2026-11-09T14:01:18.614326Z"}]}}