Critical Denial of Service Vulnerability in qt5-qtbase Package
Summary
RLSA-2026:65993: Important: qt5-qtbase security update. Affects qt5-qtbase versions < 0:5.15.9-11.el9_8.1. Fixed in 0:5.15.9-11.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qt is a widely-used software toolkit for developing cross-platform applications, providing essential tools for string manipulation, XML processing, and network handling. The qt5-qtbase package is a core component of the Qt framework, enabling developers to create robust applications. However, it has been identified that this package is susceptible to a Denial of Service (DoS) attack due to an out-of-bounds read issue in text codec handling.
Vulnerability Detail
The vulnerability, identified as CVE-2026-9499, allows attackers to exploit an out-of-bounds read in the text codec handling of the qt5-qtbase package. This can lead to a Denial of Service (DoS), where the application becomes unresponsive or crashes, potentially affecting the availability of services relying on the affected application. The vulnerability arises from improper handling of certain input data, which can be manipulated to trigger the out-of-bounds condition.
How To Fix
Minimum fixed version
0:5.15.9-11.el9_8.1
This is the first release that contains the fix.
sudo dnf update qt5-qtbaseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input data processed by the application to avoid triggering the vulnerability until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The qt5-qtbase package has a critical vulnerability (CVE-2026-9499) that can lead to Denial of Service attacks. It is crucial for users to update to the latest patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for qt5-qtbase →
FAQ
CVE-2026-9499 is a vulnerability in the qt5-qtbase package that allows for a Denial of Service due to an out-of-bounds read in text codec handling.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check if your application is affected without requiring signup.
The primary consequence is a Denial of Service, where the application may become unresponsive or crash, affecting service availability.
Yes, a patched version of the qt5-qtbase package is available. Users should update to version 0:5.15.9-11.el9_8.1 or later.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for qt5-qtbase.
