| Name | CVE-2026-11573 |
| Description | Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| qt6-base (PTS) | bookworm | 6.4.2+dfsg-10 | vulnerable |
| trixie | 6.8.2+dfsg-9+deb13u2 | fixed | |
| forky, sid | 6.10.2+dfsg-16 | fixed | |
| qtbase-opensource-src (PTS) | bookworm | 5.15.8+dfsg-11+deb12u3 | vulnerable |
| trixie | 5.15.15+dfsg-6+deb13u1 | vulnerable | |
| forky, sid | 5.15.19+dfsg-4 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| qt6-base | source | (unstable) | 6.8.2+dfsg-5 | unimportant | ||
| qtbase-opensource-src | source | (unstable) | (unfixed) | unimportant |
https://codereview.qt-project.org/c/qt/qtbase/+/606899
https://github.com/qt/qtbase/commit/387633a6069a5e0e9b976971691b1b82725b6132 (v6.9.0-beta1)
https://github.com/qt/qtbase/commit/948599e7b71f59fd9c9c0f7f3d1987ec93a23490 (v6.8.2)
Only exploitable on Windows