CVE-2026-76151: Qt QtNetwork DOS Vulnerability

CVE-2026-76151 Overview

CVE-2026-76151 is an out-of-bounds read vulnerability in the QtNetwork module of Qt 6. The flaw exists in the HTTP Cache-Control response header parser used by QNetworkAccessManager. A malicious or compromised HTTP server can return an excessively large Cache-Control header value that triggers a buffer over-read in the client. The result is an application crash and denial of service. The out-of-bounds access is read-only, so no information disclosure or code execution occurs. Only client-side connections are affected, and 32-bit builds are not vulnerable.

Critical Impact
Remote attackers controlling an HTTP endpoint can crash Qt 6 client applications that use QNetworkAccessManager by sending a crafted Cache-Control response header.

Affected Products

Qt Group Qt versions 6.0.0 through 6.8.8
Qt Group Qt versions 6.9.0 through 6.11.1
Applications using QNetworkAccessManager in 64-bit builds

Discovery Timeline

2026-09-16 - CVE-2026-76151 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76151

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the HTTP header parsing logic of QtNetwork. When QNetworkAccessManager processes an HTTP response, it parses the Cache-Control header to extract directives such as max-age and s-maxage. The parser fails to correctly bound its reads when the header value exceeds an internal size threshold. Reading past the end of the allocated buffer causes the process to abort or segfault, terminating the client application.

The read-only nature of the access limits the impact to availability. Attackers cannot leak process memory or achieve code execution through this flaw. However, any Qt 6 desktop, mobile, or embedded application that fetches resources from attacker-influenced HTTP endpoints becomes a denial-of-service target.

Root Cause

The root cause is missing or incorrect boundary validation during pointer arithmetic in the Cache-Control header tokenizer. On 64-bit builds, the parser advances a pointer beyond the header buffer when handling an excessively long value. 32-bit builds are unaffected due to differences in the integer arithmetic paths involved.

Attack Vector

Exploitation requires the victim application to issue an HTTP request to an attacker-controlled or compromised server. The attacker returns a response containing an oversized Cache-Control header. When QNetworkAccessManager parses the response, the buffer over-read triggers a crash. Man-in-the-middle attackers on unencrypted HTTP connections can also inject the malicious header into legitimate responses.

See the Qt Project Code Review for the upstream patch and technical details of the affected parser.

Detection Methods for CVE-2026-76151

Indicators of Compromise

Unexpected crashes of Qt 6 client applications shortly after outbound HTTP requests
Core dumps or Windows Error Reporting entries referencing QtNetwork symbols and Cache-Control parsing frames
HTTP response captures containing Cache-Control header values of anomalous length from untrusted origins

Detection Strategies

Inspect network traffic for HTTP responses with Cache-Control header values exceeding typical directive sizes
Correlate application crash telemetry with recent network activity from Qt-based processes
Monitor endpoint process termination events tied to binaries linked against Qt6Network

Monitoring Recommendations

Enable crash reporting for all Qt 6 client applications and forward stack traces to a central SIEM
Log outbound HTTP connections initiated by Qt applications and alert on repeated crash-to-connection patterns
Deploy TLS inspection or upstream proxies to record response headers from untrusted destinations

How to Mitigate CVE-2026-76151

Immediate Actions Required

Inventory applications and embedded systems built against Qt 6 versions 6.0.0–6.8.8 and 6.9.0–6.11.1
Restrict Qt-based clients to trusted HTTPS endpoints where feasible
Prioritize patching of internet-facing or user-facing Qt applications that use QNetworkAccessManager

Patch Information

The upstream fix is available through the Qt Project code review referenced as qtbase change 752129. Rebuild affected applications against a patched Qt 6 release once vendors publish updated point versions in the 6.8.x and 6.11.x branches.

Workarounds

Route Qt application HTTP traffic through a proxy that strips or truncates oversized Cache-Control response headers
For environments where rebuilding is infeasible, build or run the affected application as a 32-bit binary, which is not vulnerable
Disable or avoid HTTP fetches to untrusted origins until a patched Qt build is deployed

bash

# Example proxy rule to cap Cache-Control response header length (nginx)
proxy_hide_header Cache-Control;
add_header Cache-Control "no-cache" always;