https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-366715 EUVD-2026-366715 https://cve.radiocsirt.org/vuln/euvd-2026-366715 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11573 <p>Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator&lt;&lt;(QTextStream&amp;, const QDomNode&amp;). Denial of service only — no code execution and no memory disclosure.</p> <p>Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator&lt;&lt;(QTextStream&amp;, const QDomNode&amp;). Denial of service only — no code execution and no memory disclosure.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11573 https://cve.radiocsirt.org/vuln/ghsa-m72v-p257-4w4p <p>Uncontrolled recursion in Qt&#39;s QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).</p> <p>Uncontrolled recursion in Qt&#39;s QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).</p> https://cve.radiocsirt.org/vuln/ghsa-m72v-p257-4w4p https://cve.radiocsirt.org/vuln/msrc_cve-2026-11573 msrc_CVE-2026-11573 https://cve.radiocsirt.org/vuln/msrc_cve-2026-11573 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11573 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: qtbase-opensource-src, Ubuntu:Pro:18.04:LTS: qtbase-opensource-src, Ubuntu:Pro:20.04:LTS: qtbase-opensource-src, Ubuntu:22.04:LTS: qt6-base, Ubuntu:Pro:22.04:LTS: qtbase-opensource-src, Ubuntu:24.04:LTS: qt6-base, Ubuntu:Pro:24.04:LTS: qtbase-opensource-src, Ubuntu:26.04:LTS: qtbase-opensource-src</p> <p>Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator&lt;&lt;(QTextStream&amp;, const QDomNode&amp;). Denial of service only — no code execution and no memory disclosure.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: qtbase-opensource-src, Ubuntu:Pro:18.04:LTS: qtbase-opensource-src, Ubuntu:Pro:20.04:LTS: qtbase-opensource-src, Ubuntu:22.04:LTS: qt6-base, Ubuntu:Pro:22.04:LTS: qtbase-opensource-src, Ubuntu:24.04:LTS: qt6-base, Ubuntu:Pro:24.04:LTS: qtbase-opensource-src, Ubuntu:26.04:LTS: qtbase-opensource-src</p> <p>Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator&lt;&lt;(QTextStream&amp;, const QDomNode&amp;). Denial of service only — no code execution and no memory disclosure.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11573 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3227 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3227