Description
A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.
Published: 2026-10-23
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: Denial of Service via Application Crash
Action: Patch
AI Analysis

Impact

A use‑after‑free condition exists in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module. An attacker or compromised HTTP/2 server can trigger the bug, causing the client application to free an object that is still in use and then crash. The impact is a loss of availability for the affected application, but there is no direct compromise of confidentiality or integrity.

Affected Systems

The vulnerability affects Qt applications that use the QNetworkAccessManager HTTP/2 client component. Specific product versions are not listed in the report, so any installation that includes the Qt Network module and its HTTP/2 support may be impacted until a patch is applied.

Risk and Exploitability

The CVSS score of 2.1 indicates very low severity, and no EPSS data or KEV listing is available, suggesting the likelihood of exploitation is currently low or not observed in the wild. The likely attack vector is remote, originating from a malicious or compromised HTTP/2 server interacting with a Qt client. Because the bug only leads to a crash and does not provide an attacker with code execution or privilege escalation, the overall risk remains limited to availability disruption.

Generated by OpenCVE AI on October 23, 2026 at 12:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Qt release that contains the fix for this vulnerability
  • If an upgrade is not immediately feasible, restrict the application to trusted HTTP/2 servers or block traffic from untrusted sources
  • Monitor application logs for crashes triggered by HTTP/2 requests and apply additional safeguards such as guarded memory handling or defensive coding practices

Generated by OpenCVE AI on October 23, 2026 at 12:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.
Title Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt
First Time appeared Qt
Qt qt
Weaknesses CWE-416
CPEs cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
Vendors & Products Qt
Qt qt
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green'}

Subscriptions

Qt Qt
cve-icon MITRE

Status: PUBLISHED

Assigner: Qt

Published:

Updated: 2026-10-23T10:56:15.281Z

Reserved: 2026-09-22T10:27:08.400Z

Link: CVE-2026-95620

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T12:18:20.080

Modified: 2026-10-23T12:18:20.080

Link: CVE-2026-95620

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T12:45:17Z

Weaknesses