On Tue, Nov 03, 2026 at 10:09:57PM +0100, Patrick Franz wrote: > Hi, > > On Tue, 3 Nov 2026 05:27:30 -0800 Sumit Verma > <[email protected]> wrote: > > Control: tags -1 + fixed-upstream > > > > Hi, > > > > The Qt wiki entry has now been filled in: CVE-2026-105924 affects Qt > > 5.12.0 to 6.8.9 and 6.9.0 to 6.11.2, and is fixed in 6.8.10, 6.11.3 > and > > 6.12.1. > > > > Upstream fix, in the public qt/qtbase GitHub mirror: > > "JSON/CBOR: fix crash converting an empty URL tag to JSON" > > (Fixes: QTBUG-149841) > > dev: 9e9988ee57c0210a5ba57435182b094f50b50f28 > > 6.11: 08c5ae85586ef9ef6b3f80f98f367de48c6db3d0 (contained in tag > v6.11.3) > > https://www.google.com/url?q=https://github.com/qt/qtbase/commit/ > 08c5ae85586ef9ef6b3f80f98f367de48c6db3d0 > > Are you sure that's the correct one ? Because > 08c5ae85586ef9ef6b3f80f98f367de48c6db3d0 is the fix for CVE-2026-107157: > https://security-tracker.debian.org/tracker/CVE-2026-107157
Can we nudge someone in Qt to open up https://codereview.qt-project.org/c/qt/qtbase/+/766809 ? Cheers, Moritz
