CVE-2026-11573: Qt XML Module Stack Exhaustion DOS Vulnerability

CVE-2026-11573 Overview

CVE-2026-11573 is an uncontrolled recursion vulnerability [CWE-674] in the Qt XML module (QtXml, qtbase). The flaw resides in the QDomDocument/QDomNode serialization path, where QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually without any depth limit. Each level of element nesting consumes one stack frame, with no configurable bound and no error return path. A maliciously crafted document with deeply nested elements parses successfully but exhausts the call stack during serialization, terminating the host process. The issue affects Qt 4.0 and later versions and is reachable through common serialization APIs including QDomDocument::toByteArray(), QDomDocument::toString(), and QDomNode::save().

Critical Impact
Any application that parses attacker-controlled XML with Qt's DOM API and later serializes it can be crashed by a single deeply nested document. The impact is limited to denial of service — no code execution or memory disclosure.

Affected Products

Qt qtbase — QtXml module, version 4.0 and later
QDomDocument serialization APIs: toByteArray(), toString(), toCString()
QDomNode::save() and operator<<(QTextStream&, const QDomNode&)

Discovery Timeline

2026-09-08 - CVE-2026-11573 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-11573

Vulnerability Analysis

The vulnerability sits in the recursive descent used to walk a DOM tree during serialization. When Qt writes a QDomDocument back out as XML text or bytes, QDomElementPrivate::save() iterates over child nodes and invokes QDomNodePrivate::save() for each. Element children reenter QDomElementPrivate::save(), producing mutual recursion that mirrors document depth one-to-one on the call stack. Because Qt applies no depth check, no bound configurable by the application, and no failure return value, the recursion continues until the operating system enforces the stack limit. The process terminates with a stack overflow signal, taking down any service that performs serialization on untrusted input.

Root Cause

The root cause is missing depth accounting in the DOM serialization traversal. Qt's parser accepts arbitrarily nested input without complaint, so the malicious document is fully constructed in memory. The mismatch between what the parser accepts and what the serializer can safely handle produces the crash. Fixing the issue requires either an iterative rewrite of the save path or an explicit depth cap enforced before recursion.

Attack Vector

An attacker supplies an XML document with thousands of nested elements to any Qt-based service or client that will later re-serialize the parsed tree. Typical reachable paths include configuration loaders, IPC handlers, SOAP or XMPP clients, feed readers, and file conversion utilities. Exploitation requires network delivery of the payload and, per the CVSS 4.0 vector, some form of user or application interaction to trigger the serialization call. The result is process termination each time the payload is processed, enabling repeatable denial of service. See the Qt Project Code Review for the upstream fix discussion.

Detection Methods for CVE-2026-11573

Indicators of Compromise

Repeated crash signals (SIGSEGV with stack-overflow signature) in Qt-based processes shortly after XML ingestion.
Core dumps showing alternating QDomElementPrivate::save and QDomNodePrivate::save frames extending to the stack limit.
Inbound XML documents whose element nesting depth exceeds a few hundred levels, particularly from untrusted origins.

Detection Strategies

Instrument XML ingestion points to measure element depth before handing documents to QDomDocument.
Enable core dump collection on Qt applications and alert on stack-exhaustion terminations correlated with recent network input.
Baseline typical XML depth for each application and flag statistical outliers as suspicious payloads.

Monitoring Recommendations

Forward Qt application crash telemetry and OS-level signal events to a central log platform for correlation with request logs.
Track process restart rates for services that consume XML from external peers; sudden restart clusters indicate probing.
Monitor inbound XML payload size distribution and nesting depth at proxies or application gateways.

How to Mitigate CVE-2026-11573

Immediate Actions Required

Inventory applications that link QtXml and identify code paths that call QDomDocument::toByteArray(), toString(), toCString(), or QDomNode::save() on externally supplied input.
Enforce a maximum XML nesting depth at the application boundary before invoking Qt DOM APIs.
Restart or supervise affected services so that a crash-based DoS is contained and observable.

Patch Information

The upstream fix is tracked in the Qt Project Code Review. Rebuild affected Qt-based applications against a patched qtbase once the fix is merged into a supported Qt release branch and distributed by the vendor.

Workarounds

Pre-validate incoming XML with a streaming parser such as QXmlStreamReader and reject documents that exceed a safe depth threshold (for example, 256 levels).
Route XML processing through an isolated worker process so a stack overflow terminates only the worker, not the parent service.
Where possible, avoid re-serializing untrusted QDomDocument instances; consume the parsed data directly instead of round-tripping to text.

bash

# Example: reject deeply nested XML before calling QDomDocument
# Pseudocode for a pre-validation step using QXmlStreamReader
#   int depth = 0, max_seen = 0;
#   while (reader.readNextStartElement()) {
#       depth++;
#       max_seen = std::max(max_seen, depth);
#       if (max_seen > 256) reject_document();
#       // ... recurse into children, decrement on end element
#   }