There is an update regarding the null pointer dereference vulnerability in the Qt QNetworkAccessManager class of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-96432.
Update: Added credit to Daniel Birtwhistle, which was omitted from the original advisory. The original advisory is included below. Affected versions: from 6.8.0 to 6.8.9, from 6.9.0 to 6.11.2 Impact: Availability — a malicious or compromised server can trigger the condition, causing the affected application to crash. CVSS 4.0 Score: 2.1 / Low Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green Mitigation: Disable HTTP/2 using QNetworkRequest::setAttribute(QNetworkRequest::Http2AllowedAttribute, false). Solution: Apply the following patch or update to Qt 6.8.10, Qt 6.11.3 or later. Patches: Qt 6.11: https://codereview.qt-project.org/c/qt/qtbase/+/768246 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-96432-qtbase-6.11.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/774283 or https://download.qt.io/archive/qt/6.8/CVE-2026-96432-qtbase-6.8.diff Credit: We would like to thank Daniel Birtwhistle for discovering and responsibly reporting this vulnerability, and for his help in verifying the fix. The original report " A null pointer dereference vulnerability in the Qt QNetworkAccessManager class of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-96432. Affected versions: from 6.8.0 to 6.8.9, from 6.9.0 to 6.11.2 Impact: Availability — a malicious or compromised server can trigger the condition, causing the affected application to crash. CVSS 4.0 Score: 2.1 / Low Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green Mitigation: Disable HTTP/2 using QNetworkRequest::setAttribute(QNetworkRequest::Http2AllowedAttribute, false). Solution: Apply the following patch or update to Qt 6.8.10, Qt 6.11.3 or later. Patches: Qt 6.11: https://codereview.qt-project.org/c/qt/qtbase/+/768246 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-96432-qtbase-6.11.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/774283 or https://download.qt.io/archive/qt/6.8/CVE-2026-96432-qtbase-6.8.diff <https://download.qt.io/archive/qt/6.8/CVE-2026-96432-qtbase-6.8.diff>" Tommi M. Tauriainen Qt Group Confidential
_______________________________________________ Announce mailing list [email protected] https://lists.qt-project.org/listinfo/announce
-- Development mailing list [email protected] https://lists.qt-project.org/listinfo/development
