Critical Use After Free Vulnerability in Qt's QHttp2ProtocolHandler (CVE-2025-5991)
Summary
CVE-2025-5991: There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. Affects qt6-base versions 6.4.2+dfsg-10 – 6.8.2+dfsg-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qt is a widely-used open-source framework for developing cross-platform applications. The QtNetwork module facilitates network communication, including HTTP and HTTP/2 protocols. The vulnerability in question specifically affects the handling of HTTP/2 requests, which is crucial for modern web applications that rely on efficient data transfer.
Vulnerability Detail
The vulnerability identified as CVE-2025-5991 is a 'Use After Free' issue in the QHttp2ProtocolHandler of the QtNetwork module. It arises from a race condition between the QHttp2Stream's handling of POST request body uploads and the processing of HTTP error responses. This flaw can lead to unpredictable behavior, including application crashes or the execution of arbitrary code, thereby compromising the integrity and security of applications utilizing this module.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using HTTP/2 features in their applications until they can update to the patched version. This may involve configuring the application to use HTTP/1.1 instead, which can be done by modifying the network settings in the application code.
Conclusion
CVE-2025-5991 is a significant vulnerability in the QtNetwork module that requires immediate attention. Users are advised to update to the latest version to mitigate risks associated with this flaw. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for qt6-base →
FAQ
CVE-2025-5991 is a critical vulnerability in the QtNetwork module that affects HTTP/2 handling, leading to potential application crashes or arbitrary code execution.
The vulnerability affects Qt version 6.9.0. It has been fixed in version 6.9.1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to access the code.
If an immediate update is not possible, consider disabling HTTP/2 features in your application as a temporary workaround.
More details can be found in the official CVE database or by visiting the Qt project's security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for qt6-base.
