{"id":"CVE-2026-114369","kind":"vulnerability","aliases":["CVE-2026-114369"],"related":[],"title":"Qt WebSockets: resource exhaustion in QWebSocket and QWebSocketServer classes","description":"Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module","summary":"The Qt Framework's WebSockets module has a flaw in its QWebSocket and QWebSocketServer classes that can exhaust resources. An attacker who can reach a Qt WebSocket endpoint can make the application consume excessive resources.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","qt","qt-websockets","runtime"],"not_affected_if":["no-websocket-server","not-using-qt-websockets"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T12:18:19+00:00","first_seen_at":"2026-11-12T12:38:17+00:00","triaged_at":"2026-11-12T12:40:35+00:00","updated_at":"2026-11-12T12:40:35+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-12T12:40:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Qt WebSockets: resource exhaustion in QWebSocket and QWebSocketServer classes","impact":"low","summary":"The Qt Framework's WebSockets module has a flaw in its QWebSocket and QWebSocketServer classes that can exhaust resources. An attacker who can reach a Qt WebSocket endpoint can make the application consume excessive resources.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["qt","qt-websockets","c++"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Application becomes unresponsive from resource exhaustion","analyst_note":"Find the affected Qt versions and fixed release in the NVD entry or Qt advisories, and confirm whether the attack needs a server-side QWebSocketServer or also affects clients.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-websocket-server","not-using-qt-websockets"],"who_is_affected":"Applications built with the Qt WebSockets module that accept WebSocket connections, particularly servers using QWebSocketServer. Applications that only act as WebSocket clients or do not use the Qt WebSockets module are likely not affected. The sources do not say which Qt versions are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":4513,"output_tokens":508,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114369':12A,15A '-2026':11A,14A 'applic':53B 'attack':42B 'c':16B 'class':9A,36B,67C 'consum':54B 'cve':10A,13A 'endpoint':49B 'excess':55B 'exhaust':4A,39B,58C 'flaw':30B 'framework':24B,63C 'make':51B 'modul':27B,72C 'qt':1A,17B,19B,23B,47B,62C,70C 'qt-websocket':18B 'qwebsocket':6A,33B,64C 'qwebsocketserv':8A,35B,66C 'reach':45B 'resourc':3A,40B,56B,57C 'runtim':21B 'vulner':59C 'websocket':2A,20B,26B,48B,71C","nicknames":[],"mitigations":[],"who_affected":"Applications built with the Qt WebSockets module that accept WebSocket connections, particularly servers using QWebSocketServer. Applications that only act as WebSocket clients or do not use the Qt WebSockets module are likely not affected. The sources do not say which Qt versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","low","qt","qtwebsockets","runtime"],"campaign_type":null,"search_a":"'-114369':12A,15A '-2026':11A,14A 'class':9A 'cve':10A,13A 'exhaust':4A 'qt':1A 'qwebsocket':6A 'qwebsocketserv':8A 'resourc':3A 'websocket':2A","search_b":"'applic':53B 'attack':42B 'c':16B 'class':36B 'consum':54B 'endpoint':49B 'excess':55B 'exhaust':39B 'flaw':30B 'framework':24B 'make':51B 'modul':27B 'qt':17B,19B,23B,47B 'qt-websocket':18B 'qwebsocket':33B 'qwebsocketserv':35B 'reach':45B 'resourc':40B,56B 'runtim':21B 'websocket':20B,26B,48B","search_c":"'class':67C 'exhaust':58C 'framework':63C 'modul':72C 'qt':62C,70C 'qwebsocket':64C 'qwebsocketserv':66C 'resourc':57C 'vulner':59C 'websocket':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T12:18:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:L/U:Clear","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114369","severity":null,"published_at":"2026-11-12T12:18:19+00:00","modified_at":"2026-11-12T12:18:19+00:00","first_seen_at":"2026-11-12T12:38:17+00:00","fetched_at":"2026-11-12T12:38:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}