Executive brief
Qt is a widely-used cross-platform application framework that handles network communications. A flaw in the HTTP Cache-Control header parsing can cause an application using Qt's network features to crash when receiving a maliciously crafted HTTP response from an untrusted server, resulting in denial of service and application downtime.
Technical details
An out-of-bounds read vulnerability exists in the QtNetwork module's HTTP Cache-Control response header parsing logic. The vulnerability affects Qt 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1 on 64-bit builds. When an application using QNetworkAccessManager receives an excessively large Cache-Control header value from a remote HTTP server, a buffer over-read occurs, causing an application crash. The vulnerability requires network-reachable access to provide a malicious HTTP response and affects only client-side connections. The out-of-bounds access is read-only with no code execution or information disclosure possible.
Affected products
- Qt Group Qt 6.0.0 through 6.8.8, 6.9.0 through 6.11.1
Timeline
- 2026-09-16: disclosed