{"id":"CVE-2026-116337","kind":"vulnerability","aliases":["CVE-2026-116337"],"related":[],"title":"Qt Network: HTTP response handling can consume uncontrolled resources","description":"Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.","summary":"The Qt Framework's Network module mishandles HTTP responses in a way that lets a remote server consume uncontrolled resources on the client. An attacker can cause excess memory or CPU use in an application that fetches data over HTTP.","severity":"low","cvss":0.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","desktop-apps","embedded","qt","runtime"],"not_affected_if":["no-http-requests","trusted-servers-only"],"how_to_check":"- Check whether the application uses the Qt Network module (QNetworkAccessManager) to make HTTP requests.\n- Check the Qt version in use, for example with `qmake --version` or the Qt version in the build configuration.","fix":null,"status":"open","published_at":"2026-11-09T09:16:58+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","triaged_at":"2026-11-09T09:26:18+00:00","updated_at":"2026-11-09T09:26:18+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-09T09:26:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Qt Network: HTTP response handling can consume uncontrolled resources","impact":"low","summary":"The Qt Framework's Network module mishandles HTTP responses in a way that lets a remote server consume uncontrolled resources on the client. An attacker can cause excess memory or CPU use in an application that fetches data over HTTP.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["qt","c++","desktop-apps","embedded"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"remote server exhausts client memory or CPU resources","analyst_note":"Find the affected and fixed Qt versions and the attack details in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116337 and the Qt project advisories.","how_to_check":"- Check whether the application uses the Qt Network module (QNetworkAccessManager) to make HTTP requests.\n- Check the Qt version in use, for example with `qmake --version` or the Qt version in the build configuration.\n- unknown for the exact affected version ranges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-http-requests","trusted-servers-only"],"who_is_affected":"Applications built with the Qt Framework that use the Qt Network module to make HTTP requests to servers they do not fully trust. Desktop, embedded, and mobile apps that only talk to trusted internal services are less exposed. The sources do not state affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000736,"input_tokens":4500,"output_tokens":571,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116337':12A,15A '-2026':11A,14A 'app':19B 'applic':57B 'attack':47B 'c':16B 'caus':49B 'client':45B 'consum':7A,40B 'consumpt':65C 'cpu':53B 'cve':10A,13A 'data':60B 'desktop':18B 'desktop-app':17B 'embed':20B 'excess':50B 'fetch':59B 'framework':25B,70C 'function':74C 'handl':5A,73C 'http':3A,30B,62B,71C 'let':36B 'memori':51B 'mishandl':29B 'modul':28B,79C 'network':2A,27B,78C 'qt':1A,21B,24B,69C,77C 'remot':38B 'resourc':9A,42B,64C 'respons':4A,31B,72C 'runtim':22B 'server':39B 'uncontrol':8A,41B,63C 'use':54B 'vulner':66C 'way':34B","nicknames":[],"mitigations":[],"who_affected":"Applications built with the Qt Framework that use the Qt Network module to make HTTP requests to servers they do not fully trust. Desktop, embedded, and mobile apps that only talk to trusted internal services are less exposed. The sources do not state affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","desktopapps","embedded","low","qt","runtime"],"campaign_type":null,"search_a":"'-116337':12A,15A '-2026':11A,14A 'consum':7A 'cve':10A,13A 'handl':5A 'http':3A 'network':2A 'qt':1A 'resourc':9A 'respons':4A 'uncontrol':8A","search_b":"'app':19B 'applic':57B 'attack':47B 'c':16B 'caus':49B 'client':45B 'consum':40B 'cpu':53B 'data':60B 'desktop':18B 'desktop-app':17B 'embed':20B 'excess':50B 'fetch':59B 'framework':25B 'http':30B,62B 'let':36B 'memori':51B 'mishandl':29B 'modul':28B 'network':27B 'qt':21B,24B 'remot':38B 'resourc':42B 'respons':31B 'runtim':22B 'server':39B 'uncontrol':41B 'use':54B 'way':34B","search_c":"'consumpt':65C 'framework':70C 'function':74C 'handl':73C 'http':71C 'modul':79C 'network':78C 'qt':69C,77C 'resourc':64C 'respons':72C 'uncontrol':63C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T09:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116337","severity":null,"published_at":"2026-11-09T09:16:58+00:00","modified_at":"2026-11-09T09:16:58+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","fetched_at":"2026-11-09T09:25:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}