Log in Start free

Vulnerability · Published Sep 8, 2026 · Assigned by Qt

CVE-2026-11573Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

High 7.1

In plain English

A high-severity security flaw in qt from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.4%top 67.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8qt5-qtbase5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-common5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-common5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-devel5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-devel5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-examples5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-examples5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-gui5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-gui5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-mysql5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-mysql5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-odbc5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-odbc5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-postgresql5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-postgresql5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-private-devel5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-private-devel5.15.9-11.el9_8.2ALSA-2026:87082
AlmaLinux:8qt5-qtbase-static5.15.3-10.el8_10ALSA-2026:93924
AlmaLinux:9qt5-qtbase-static5.15.9-11.el9_8.2ALSA-2026:87082
Debian:12qt6-baseno fix listedDEBIAN-CVE-2026-11573
Debian:13qt6-base6.8.2+dfsg-5DEBIAN-CVE-2026-11573
Debian:14qt6-base6.8.2+dfsg-5DEBIAN-CVE-2026-11573
Debian:12qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-11573
Debian:13qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-11573
Debian:14qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-11573
Rocky Linux:8qt5-qtbase0:5.15.3-10.el8_10RLSA-2026:93924
Rocky Linux:9qt5-qtbase0:5.15.9-11.el9_8.2RLSA-2026:87082
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-11573
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-11573
Ubuntu:26.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2026-11573
Ubuntu:26.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2026-11573

Affected products (as reported)

VendorProductVersions
qt qt 2.2.0 – before 6.8.2

Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References