A malformed HTTP/2 server can manipulate its control frames to leave a Qt client in an inconsistent state. By withholding a SETTINGS ACK, the server may send a RST_STREAM on a completed stream, planting a null pointer in the QNetworkAccessManager internals. A subsequent PUSH_PROMISE for the same stream then triggers a null pointer dereference, causing the client application to crash. This constitutes a denial‑of‑service vulnerability limited to the affected application rather than the underlying operating system.

The Qt library, including the qt and qtbase components, is affected. No specific version information is provided, so all unpatched Qt deployments remain vulnerable until the patch is applied.

The CVSS score of 2.1 indicates low overall severity. The EPSS score is not available, so it is unclear how frequently attackers use this flaw, although the lack of a CISA KEV listing suggests it is not widely exploited. The attack requires a malicious or compromised HTTP/2 server to be contacted by the Qt application, implying a remote network vector that can be controlled by an adversary with influence over the server side. Because the vulnerability results only in a crash, it provides a denial‑of‑service surface that could impact end‑users or availability of mission‑critical software.