Qt Network flaw lets a malicious server exhaust memory in Qt apps
- qt
- qt-network
- denial-of-service
- cve-2026-116337
A low-severity flaw in Qt Network HTTP response handling (CVE-2026-116337, CVSS 4.0 score 0.6) can let a malicious or compromised server make a Qt app run out of memory. Update to Qt 6.8.10, Qt 6.12.1 or later, or apply Qt's patches.
On 9 November 2026 the Qt Company published an advisory for CVE-2026-116337, a low-severity flaw in how the Qt Network module handles HTTP responses. A Qt application that connects to a malicious or compromised server can run out of memory and stop working. The flaw affects Qt Framework releases from Qt 4.5.0 up to the fixed releases, Qt 6.8.10 and Qt 6.12.1. Qt's score marks exploit maturity as unreported, and the advisory does not report any exploitation.
The bugs
CVE-2026-116337, uncontrolled memory use in Qt Network HTTP response handling. This affects applications built on the Qt Framework that use the HTTP functionality in the Qt Network module, from Qt 4.5.0 up to Qt 6.8.10 and from Qt 6.9.0 up to Qt 6.12.1. Qt says the affected status of releases before Qt 4.5.0 is unknown. The attacker has to control, or have compromised, a server that the application connects to. The only impact Qt lists is availability: the application can run out of memory, which causes a denial of service. Qt does not report any loss of data or code execution. Qt scores the flaw 0.6 (Low) under CVSS 4.0, with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/R:U/RE:L/U:Green.
The remedy
A fix is available. Updating is the complete fix: move to Qt 6.8.10, Qt 6.12.1, or later. If you build Qt from source and cannot move to a new release yet, Qt has published source patches for the dev, 6.12, 6.11 and 6.8 branches. They are listed in the advisory and on Qt's list of known vulnerabilities. Applications that bundle or statically link Qt need to be rebuilt and shipped with the fixed Qt before users are protected. To confirm which Qt version an application uses at runtime, check the value returned by Qt's qVersion() function, or check the Qt version recorded by your build or package manager.
If you cannot update today
No setting makes an unpatched system safe. Qt's advisory says that no mitigation is available, so the release update or the official patch is the only remedy Qt offers. Until you can update, keep in mind that the risk comes from servers that Qt applications connect to over HTTP.