CVE-2026-114369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114369", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-10-21T10:56:06.723Z", "datePublished": "2026-11-12T11:09:29.857Z", "dateUpdated": "2026-11-12T11:09:29.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-11-12T11:09:29.857Z"}, "title": "Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-407", "description": "CWE-407 Inefficient Algorithmic Complexity", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "value": "CAPEC-227 Sustained Client Engagement"}]}], "affected": [{"vendor": "qt", "product": "Qt Framework", "modules": ["qtwebsockets"], "versions": [{"status": "unknown", "version": "0", "lessThan": "5.15.0", "versionType": "python"}, {"status": "affected", "version": "5.15.0", "lessThanOrEqual": "6.8.9", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThanOrEqual": "6.12.0", "versionType": "python"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module"}]}], "references": [{"url": "https://www.qt.io/security-advisories?search=CVE-2026-114369", "name": "Qt security advisory CVE-2026-114369", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772146", "name": "Qt dev branch", "tags": ["patch"]}, {"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772145", "name": "Qt dev branch", "tags": ["patch"]}, {"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772144", "name": "Qt dev branch", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "AUTOMATIC", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "CLEAR", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:A/RE:L/U:Clear"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["qtwebsockets"], "product": "Qt Framework", "vendor": "qt", "versions": [{"lessThan": "5.15.0", "status": "unknown", "version": "0", "versionType": "python"}, {"lessThanOrEqual": "6.8.9", "status": "affected", "version": "5.15.0", "versionType": "python"}, {"lessThanOrEqual": "6.12.0", "status": "affected", "version": "6.9.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module"}], "id": "CVE-2026-114369", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}, "published": "2026-11-12T12:18:19.057", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772144"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772145"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772146"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://www.qt.io/security-advisories?search=CVE-2026-114369"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{"bugzilla": {"description": "qt: qt: Denial of Service via resource exhaustion in Qt WebSockets", "id": "2572335", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572335"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Qt. A remote attacker can cause a Denial of Service (DoS) through resource exhaustion within the QWebSocket and QWebSocketServer classes of the Qt WebSockets module. By triggering excessive resource consumption over the network without requiring authentication, an attacker can degrade application performance and impact service availability."], "mitigation": {"lang": "en:us", "value": "Limit network exposure by configuring firewall rules to restrict access to the WebSocket port so that only trusted clients or internal subnets can connect.\nFor example, to remove public access and allow only a specific trusted subnet via firewalld (replace <PORT> and <TRUSTED_CIDR> with your environment settings):\nfirewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CIDR>\nfirewall-cmd --reload\nAlternatively, if Qt WebSockets is not required by any installed application, remove the packages:\ndnf remove qt5-qtwebsockets qt6-qtwebsockets\nCaveats: Restricting firewall ports prevents untrusted external clients from establishing WebSocket connections. Removing Qt WebSockets packages may uninstall dependent graphical or third-party applications.\nWarning: Reloading firewalld with `firewall-cmd --reload` briefly resets active connection tracking, and removing packages will stop any services that depend on these libraries."}, "name": "CVE-2026-114369", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "qt6-qtwebsockets", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "qt5-qtwebsockets", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "qt5-qtwebsockets", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "qt5-qtwebsockets", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "qt5", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "qt6", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T11:09:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114369\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114369\nhttps://codereview.qt-project.org/c/qt/qtwebsockets/+/772144\nhttps://codereview.qt-project.org/c/qt/qtwebsockets/+/772145\nhttps://codereview.qt-project.org/c/qt/qtwebsockets/+/772146\nhttps://www.qt.io/security-advisories?search=CVE-2026-114369"], "statement": "This vulnerability is rated as Moderate because although it can be triggered remotely by unauthenticated actors, the impact is limited to availability degradation via resource depletion without compromising data confidentiality or system integrity. In Red Hat Enterprise Linux, Qt WebSockets is an application library rather than a default-enabled network daemon, meaning exposure is limited to environments hosting custom or third-party applications that explicitly instantiate network-facing WebSocket endpoints. Systems that do not deploy exposed Qt-based network services remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Qt Framework", "source": "cna", "vendor": "qt"}, "product": "qt", "vendor": "qt"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Qt Framework", "source": "cna", "vendor": "qt"}, "product": "qt_framework", "vendor": "qt"}], "created": "2026-11-12T13:15:03.121795+00:00", "updated": "2026-11-13T05:15:09.424624+00:00", "vendors": ["qt", "qt$PRODUCT$qt", "qt$PRODUCT$qt_framework"]}