Critical Security Update for qt5-qtbase: Denial of Service Vulnerability
Summary
ALSA-2026:65993: Important: qt5-qtbase security update. Affects qt5-qtbase versions < 5.15.9-11.el9_8.1. Fixed in 5.15.9-11.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qt5-qtbase is a fundamental component of the Qt framework, which is widely used for developing cross-platform applications. It provides essential tools for string manipulation, XML processing, and network handling. The package is integral for developers who rely on Qt for creating user interfaces and managing application logic. However, it has been found to be vulnerable to a Denial of Service (DoS) attack due to improper handling of text codecs, which can lead to application crashes or unresponsiveness.
Vulnerability Detail
The vulnerability identified as CVE-2026-9499 allows attackers to exploit an out-of-bounds read in the text codec handling of the qt5-qtbase package. This can result in a Denial of Service condition, where the application becomes unresponsive or crashes entirely. The issue originates from improper validation of input data, which can be manipulated by an attacker to trigger the vulnerability. The ramifications of this vulnerability can be severe, especially for applications that rely heavily on text processing and user input.
How To Fix
Minimum fixed version
5.15.9-11.el9_8.1
This is the first release that contains the fix.
sudo dnf update qt5-qtbaseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input data processed by the application or implement additional validation checks on the data before it is passed to the text codec handling functions. However, the best approach is to apply the security update as soon as possible.
Conclusion
The qt5-qtbase package is critical for many applications, and the identified vulnerability CVE-2026-9499 poses a significant risk. It is crucial to apply the available security update to protect applications from potential Denial of Service attacks. Regular monitoring and prompt updates are essential to maintain application security.
See every vulnerability recorded for qt5-qtbase →
FAQ
CVE-2026-9499 is a security vulnerability in the qt5-qtbase package that allows for a Denial of Service attack due to an out-of-bounds read in text codec handling.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The consequences include potential application crashes and unresponsiveness, which can disrupt user experience and lead to data loss.
Yes, a patch is available in the form of an updated package version 5.15.9-11.el9_8.1, which addresses the vulnerability.
If you cannot update immediately, consider implementing input validation as a temporary workaround to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for qt5-qtbase.
