[Announce] Security Advisory CVE-2026-114369: Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework

[List for announcements regarding Qt releases and development]

Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module has been discovered and has been assigned the CVE id CVE-2026-114369.
Affected versions: from Qt 5.15.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.12.0 (QWebSocketServer is affected from Qt 5.15.0 onwards, QWebSocket from Qt 6.3.0 onwards.)
Affected status unknown before Qt 5.15.0
Impact: Availability. A remote peer can cause excessive CPU consumption in applications using the affected classes, which may result in denial of service.
CVSS 4.0 Score: 2.7 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:A/RE:L/U:Clear
Mitigation: No mitigation is available.
Solution: Apply the following patches or update to Qt 6.8.10 or Qt 6.12.1 or later.
Patches:
dev: https://codereview.qt-project.org/c/qt/qtwebsockets/+/772146 https://codereview.qt-project.org/c/qt/qtwebsockets/+/772145 https://codereview.qt-project.org/c/qt/qtwebsockets/+/772144
6.12: https://codereview.qt-project.org/c/qt/qtwebsockets/+/774226 https://codereview.qt-project.org/c/qt/qtwebsockets/+/774218 https://codereview.qt-project.org/c/qt/qtwebsockets/+/774219 or https://download.qt.io/official_releases/qt/6.12/CVE-2026-114369-qtwebsockets-6.12.zip
6.11: https://codereview.qt-project.org/c/qt/qtwebsockets/+/774238 https://codereview.qt-project.org/c/qt/qtwebsockets/+/776327 https://codereview.qt-project.org/c/qt/qtwebsockets/+/776784 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-114369-qtwebsockets-6.11.zip
6.8: https://codereview.qt-project.org/c/qt/tqtc-qtwebsockets/+/774256 https://codereview.qt-project.org/c/qt/tqtc-qtwebsockets/+/776329 https://codereview.qt-project.org/c/qt/tqtc-qtwebsockets/+/774231 or https://download.qt.io/archive/qt/6.8/CVE-2026-114369-qtwebsockets-6.8.zip

Joni Poikelin
Qt Group

Confidential
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/announce/attachments/20261112/a3e7f4fd/attachment.htm>