CVE-2026-110944 · Package
NO FIX YET
The QHttpServer component of the Qt framework mishandles HTTP requests in a way that consumes excessive resources. An attacker who can send requests to an affected Qt HTTP server can slow it down or exhaust its memory or CPU.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications built with Qt's QHttpServer module that accept HTTP requests from untrusted clients may be exposed. Desktop or embedded programs that only use Qt without exposing an HTTP listener are not affected. The sources do not list affected Qt versions.
Not affected if no-http-listener, no-qhttpserver
Who cares c++, qhttpserver, qt
QHttpServer.qmake --version or the Qt installation path.No fix yet, per the sources.
Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.
This page as .md · .json · in your agent: get_signal("CVE-2026-110944") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.