CVE-2026-76151
EUVD-2026-8038516.09.2026, 10:16
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| qt | qt | 6.0.0 ≤ 𝑥 < 6.8.9 | CNA |
| qt | qt | 6.9.0 ≤ 𝑥 < 6.11.2 | CNA |
Debian Releases
Ubuntu Releases
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| qt5-qtbase |
| ||
| qt5-qtbase-common |
| ||
| qt5-qtbase-debuginfo |
| ||
| qt5-qtbase-devel |
| ||
| qt5-qtbase-examples |
| ||
| qt5-qtbase-gui |
| ||
| qt5-qtbase-mysql |
| ||
| qt5-qtbase-odbc |
| ||
| qt5-qtbase-postgresql |
| ||
| qt5-qtbase-private-devel |
| ||
| qt5-qtbase-static |
|
Common Weakness Enumeration