{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110944", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-10-15T08:37:03.372Z", "datePublished": "2026-11-04T07:04:07.151Z", "dateUpdated": "2026-11-09T21:21:33.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-11-04T07:04:07.151Z"}, "title": "Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "affected": [{"vendor": "qt", "product": "Qt Framework", "modules": ["qthttpserver"], "versions": [{"status": "affected", "version": "6.4.0", "lessThan": "6.11.3", "versionType": "python"}, {"status": "affected", "version": "6.12.0", "lessThan": "6.12.1", "versionType": "python"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qthttpserver:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server."}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-110944:", "name": "Qt wiki: List of known vulnerabilities in Qt products", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qthttpserver/+/768560", "tags": ["patch"]}, {"url": "https://codereview.qt-project.org/c/qt/qthttpserver/+/768934", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "GREEN", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/R:U/RE:L/U:Green"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T21:21:17.530580Z", "id": "CVE-2026-110944", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T21:21:33.178Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110944", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-10-15T08:37:03.372Z", "datePublished": "2026-11-04T07:04:07.151Z", "dateUpdated": "2026-11-09T21:21:33.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-11-04T07:04:07.151Z"}, "title": "Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "affected": [{"vendor": "qt", "product": "Qt Framework", "modules": ["qthttpserver"], "versions": [{"status": "affected", "version": "6.4.0", "lessThan": "6.11.3", "versionType": "python"}, {"status": "affected", "version": "6.12.0", "lessThan": "6.12.1", "versionType": "python"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qthttpserver:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server."}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-110944:", "name": "Qt wiki: List of known vulnerabilities in Qt products", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qthttpserver/+/768560", "tags": ["patch"]}, {"url": "https://codereview.qt-project.org/c/qt/qthttpserver/+/768934", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "GREEN", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/R:U/RE:L/U:Green"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110944", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T21:21:17.530580Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T21:21:28.283Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qthttpserver:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["qthttpserver"], "product": "Qt Framework", "vendor": "qt", "versions": [{"lessThan": "6.11.3", "status": "affected", "version": "6.4.0", "versionType": "python"}, {"lessThan": "6.12.1", "status": "affected", "version": "6.12.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server."}], "id": "CVE-2026-110944", "lastModified": "2026-11-09T22:18:23.523", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110944", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T21:21:17.530580Z", "version": "2.0.3"}}]}, "published": "2026-11-04T08:17:15.313", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qthttpserver/+/768560"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qthttpserver/+/768934"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-110944:"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{"bugzilla": {"description": "qt6: QHttpServer: Denial of Service via HTTP request resource exhaustion", "id": "2566745", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566745"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.", "A flaw was found in the QHttpServer component of Qt. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests that cause excessive resource consumption during request processing. Successful exploitation can lead to a Denial of Service (DoS), making the server unresponsive to legitimate traffic."], "name": "CVE-2026-110944", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "qt6", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "qt6", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-04T07:04:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110944\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110944\nhttps://codereview.qt-project.org/c/qt/qthttpserver/+/768560\nhttps://codereview.qt-project.org/c/qt/qthttpserver/+/768934\nhttps://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-110944:"], "statement": "An unauthenticated remote attacker can exhaust server resources, causing a denial of service and disrupting availability without requiring privileges or user interaction. In Red Hat Enterprise Linux and related platforms, the QHttpServer library is not exposed by default system services, confining exposure to custom or third-party applications that embed this component. The impact is limited to the availability of the handling service, with no compromise of data confidentiality or system integrity.", "threat_severity": "Important"}