{"id":"CVE-2026-110944","kind":"vulnerability","aliases":["CVE-2026-110944"],"related":[],"title":"Qt HTTP Server: request handling lets an attacker exhaust resources","description":"Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.","summary":"The QHttpServer component of the Qt framework mishandles HTTP requests in a way that consumes excessive resources. An attacker who can send requests to an affected Qt HTTP server can slow it down or exhaust its memory or CPU.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","qhttpserver","qt"],"not_affected_if":["no-http-listener","no-qhttpserver"],"how_to_check":"- Check whether an application links the Qt HTTP Server module (QHttpServer), for example by searching the project for `QHttpServer`.\n- Check the Qt version in use, for example with `qmake --version` or the Qt installation path.","fix":null,"status":"open","published_at":"2026-11-04T08:17:15+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","triaged_at":"2026-11-04T08:26:37+00:00","updated_at":"2026-11-04T08:26:37+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-04T08:26:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Qt HTTP Server: request handling lets an attacker exhaust resources","impact":"low","summary":"The QHttpServer component of the Qt framework mishandles HTTP requests in a way that consumes excessive resources. An attacker who can send requests to an affected Qt HTTP server can slow it down or exhaust its memory or CPU.","audience":"developers","category":"package","nicknames":[],"who_cares":["qt","qhttpserver","c++"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Service slows down or becomes unavailable from resource exhaustion","analyst_note":"Find affected and fixed Qt versions and the request type that triggers the exhaustion, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110944 or the Qt advisory.","how_to_check":"- Check whether an application links the Qt HTTP Server module (QHttpServer), for example by searching the project for `QHttpServer`.\n- Check the Qt version in use, for example with `qmake --version` or the Qt installation path.","plain_action":"","needs_analyst":true,"not_affected_if":["no-http-listener","no-qhttpserver"],"who_is_affected":"Applications built with Qt's QHttpServer module that accept HTTP requests from untrusted clients may be exposed. Desktop or embedded programs that only use Qt without exposing an HTTP listener are not affected. The sources do not list affected Qt versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000693,"input_tokens":4070,"output_tokens":572,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-110944':13A,16A '-2026':12A,15A 'affect':46B 'attack':8A,39B 'c':17B 'compon':23B,71C 'consum':35B 'cpu':59B 'cve':11A,14A 'excess':36B 'exhaust':9A,55B,61C 'framework':27B 'handl':5A,67C 'http':2A,29B,48B,65C,74C 'let':6A 'memori':57B 'mishandl':28B 'packag':18B 'qhttpserver':19B,22B,70C 'qt':1A,20B,26B,47B,73C 'request':4A,30B,43B,66C 'resourc':10A,37B,60C 'send':42B 'server':3A,49B,75C 'slow':51B 'vulner':62C 'way':33B","nicknames":[],"mitigations":[],"who_affected":"Applications built with Qt's QHttpServer module that accept HTTP requests from untrusted clients may be exposed. Desktop or embedded programs that only use Qt without exposing an HTTP listener are not affected. The sources do not list affected Qt versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","low","package","qhttpserver","qt"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110944","severity":null,"published_at":"2026-11-04T08:17:15+00:00","modified_at":"2026-11-04T08:17:15+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","fetched_at":"2026-11-04T08:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}