CVE-2026-76151 in Qt
Summary
by MITRE • 09/16/2026
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Qt Group's Qt framework, specifically within the QtNetwork module versions ranging from 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1, represents a critical security flaw rooted in improper input validation during HTTP response processing. This issue manifests as an out-of-bounds read, technically classified under CWE-125, which involves accessing memory locations beyond the intended buffer boundaries. The specific vector for this exploitation is the parsing of the Cache-Control header within HTTP responses. When an application utilizes QNetworkAccessManager to fetch resources from a remote server, it relies on the framework's internal parsers to interpret headers returned by that server. In this scenario, if the untrusted or compromised HTTP server returns a Cache-Control header with an excessively large value, the parsing logic fails to correctly bound-check the read operation, leading directly to memory corruption events that destabilize the application state.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity. Because the out-of-bounds access is strictly read-only and limited to 64-bit builds, it does not facilitate information disclosure nor allow for arbitrary code execution. However, the consequence remains severe in terms of service continuity. The memory violation triggers an immediate application crash, resulting in a denial of service condition for any client-side application relying on QNetworkAccessManager. This means that users interacting with applications built using these vulnerable versions of Qt will experience abrupt termination when encountering maliciously crafted HTTP responses. For developers and organizations deploying software that interacts with external web services, this vulnerability introduces a significant risk vector where simply visiting a compromised website or receiving a poisoned response from an API can disrupt service availability without any prior authentication or complex exploitation steps required by the attacker.
From a threat modeling perspective, this flaw aligns with ATT&CK technique T1498, specifically Network Denial of Service via resource exhaustion or protocol abuse, although it is more accurately described as a client-side crash induced by malformed input rather than server-side resource depletion. The attack surface is confined to the client side of the connection, meaning that only applications running on end-user devices are susceptible. It is important to note that 32-bit builds of Qt are not affected by this specific out-of-bounds read, likely due differences in memory layout or pointer arithmetic handling between architecture variants. This distinction highlights the importance of maintaining up-to-date build configurations and understanding how architectural differences influence vulnerability manifestation. The lack of code execution capability mitigates the severity from a critical level to high, as it prevents remote control scenarios but still necessitates urgent remediation to preserve application stability.
Mitigation strategies must focus on both immediate patching and defensive coding practices. The primary defense is upgrading the Qt framework to versions that include patches for this specific parsing logic error in the HTTP Cache-Control header handling. Developers should ensure that their CI/CD pipelines enforce minimum version requirements for dependencies, particularly those involving network communication modules like QtNetwork. Additionally, while the vulnerability resides within the library itself, adopting a zero-trust approach to external data sources is advisable. Applications should implement robust exception handling around network operations to gracefully manage crashes or unexpected behaviors caused by malformed responses from untrusted servers. For environments where upgrading immediately is not feasible, implementing a reverse proxy that sanitizes HTTP headers before they reach the client application can serve as an effective compensating control. This involves stripping or truncating excessively large header values on the server side, thereby preventing the malicious payload from ever reaching the vulnerable Qt parser logic in the client binary.