Denial of Service Vulnerability in QtCore's qDecodeDataUrl Function - Affected Packages: qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
Summary
CVE-2025-5455: An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. Affects qt6-base versions 6.4.2+dfsg-10 – 6.9.1+dfsg-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qt is a widely-used open-source framework for developing cross-platform applications. It provides a comprehensive set of libraries and tools for building graphical user interfaces, handling network communications, and managing multimedia content. The affected packages, qt6-base, qtbase-opensource-src, and qtbase-opensource-src-gles, are essential components of the Qt framework, enabling developers to create robust applications. However, a vulnerability in the private API function qDecodeDataUrl() poses a risk to applications utilizing these packages, particularly when handling malformed data URLs.
Vulnerability Detail
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is utilized in QTextDocument and QNetworkReply, and potentially in user code. If this function is called with malformed data, such as a URL containing a 'charset' parameter without a value (e.g., 'data:charset,'), it triggers an assertion failure when Qt is built with assertions enabled. This results in a denial of service (DoS) condition, causing the application to abort unexpectedly. The vulnerability affects Qt versions up to 5.15.18, 6.0.0 to 6.5.8, 6.6.0 to 6.8.3, and 6.9.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application does not pass malformed data URLs to the qDecodeDataUrl() function. Implement input validation to check for the presence of valid 'charset' parameters before processing URLs.
Conclusion
The vulnerability in the qDecodeDataUrl() function poses a significant risk of denial of service for applications using the affected Qt packages. It is crucial to update to the patched versions to mitigate this risk and ensure the stability of your applications.
See every vulnerability recorded for qt6-base →
FAQ
The vulnerability is a denial of service (DoS) issue caused by the qDecodeDataUrl() function in QtCore, which can abort the application when handling malformed data URLs.
The vulnerability affects Qt versions up to 5.15.18, 6.0.0 to 6.5.8, 6.6.0 to 6.8.3, and 6.9.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Without requiring access to the code or installation, you can check your application using a manifest file like package-lock.json.
Update the affected packages to their patched versions (qt6-base 5.15.19, 6.5.9, 6.8.4, 6.9.1; qtbase-opensource-src 5.15.19, 6.5.9, 6.8.4, 6.9.1) and implement input validation for data URLs.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for qt6-base.
