[Announce] Update on Security advisory: CVE-2026-96432 - Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

[List for announcements regarding Qt releases and development]

There is an update regarding the null pointer dereference vulnerability in the Qt QNetworkAccessManager class of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-96432.

Update: Added credit to Daniel Birtwhistle, which was omitted from the original advisory.
The original advisory is included below.

Affected versions:  from 6.8.0 to 6.8.9, from 6.9.0 to 6.11.2 Impact: Availability — a malicious or compromised server can trigger the condition, causing the affected application to crash. CVSS 4.0 Score: 2.1 / Low Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green Mitigation: Disable HTTP/2 using QNetworkRequest::setAttribute(QNetworkRequest::Http2AllowedAttribute, false). Solution: Apply the following patch or update to Qt 6.8.10, Qt 6.11.3 or later. Patches: Qt 6.11: https://codereview.qt-project.org/c/qt/qtbase/+/768246 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-96432-qtbase-6.11.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/774283 or https://download.qt.io/archive/qt/6.8/CVE-2026-96432-qtbase-6.8.diff
Credit: We would like to thank Daniel Birtwhistle for discovering and responsibly reporting this vulnerability, and for his help in verifying the fix.


The original report
"
A null pointer dereference vulnerability in the Qt QNetworkAccessManager class of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-96432.
Affected versions:  from 6.8.0 to 6.8.9, from 6.9.0 to 6.11.2
Impact: Availability — a malicious or compromised server can trigger the condition, causing the affected application to crash.
CVSS 4.0 Score: 2.1 / Low
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green
Mitigation: Disable HTTP/2 using QNetworkRequest::setAttribute(QNetworkRequest::Http2AllowedAttribute, false).
Solution: Apply the following patch or update to Qt 6.8.10, Qt 6.11.3 or later.
Patches:
Qt 6.11: https://codereview.qt-project.org/c/qt/qtbase/+/768246 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-96432-qtbase-6.11.diff
Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/774283 or https://download.qt.io/archive/qt/6.8/CVE-2026-96432-qtbase-6.8.diff
<https://download.qt.io/archive/qt/6.8/CVE-2026-96432-qtbase-6.8.diff>"

Tommi M. Tauriainen
Qt Group

Confidential
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/announce/attachments/20261027/51fddc94/attachment.htm>