CVE-2026-116337 · Runtime
NO FIX YET
The Qt Framework's Network module mishandles HTTP responses in a way that lets a remote server consume uncontrolled resources on the client. An attacker can cause excess memory or CPU use in an application that fetches data over HTTP.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built with the Qt Framework that use the Qt Network module to make HTTP requests to servers they do not fully trust. Desktop, embedded, and mobile apps that only talk to trusted internal services are less exposed. The sources do not state affected versions.
Not affected if no-http-requests, trusted-servers-only
Who cares c++, desktop-apps, embedded, qt
qmake --version or the Qt version in the build configuration.No fix yet, per the sources.
Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.