CVE-2026-76151

Name	CVE-2026-76151
Description	Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qt6-base (PTS)	bookworm	6.4.2+dfsg-10	vulnerable
	trixie	6.8.2+dfsg-9+deb13u2	vulnerable
	forky, sid	6.11.2+dfsg-5	fixed
qtbase-opensource-src (PTS)	bookworm	5.15.8+dfsg-11+deb12u3	fixed
	trixie	5.15.15+dfsg-6+deb13u1	fixed
	forky, sid	5.15.19+dfsg-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
qt6-base	source	(unstable)	6.11.2+dfsg-5
qtbase-opensource-src	source	(unstable)	(not affected)

Notes

[trixie] - qt6-base <no-dsa> (Minor issue)
[bookworm] - qt6-base <postponed> (Minor issue)
- qtbase-opensource-src <not-affected> (Specific to Qt6)
https://codereview.qt-project.org/c/qt/qtbase/+/752129