CVE-2026-19248— Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
Quick assessment
Affected
qt qt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QDomDocument 的 XML 解析在处理不可信输入时，存在可被远程触发的拒绝服务（DoS）漏洞，可能导致程序崩溃。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19248
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
Source: CVE Program / CVE List V5
Vulnerability Description
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-19248
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19248
请登录查看更多情报信息。
Other References for CVE-2026-19248 (1)
IV. Related Vulnerabilities
Same product: qt
-
CVE-2026-76151
Out-of-bounds read (buffer over-read) vulnerability in HTTP -
CVE-2026-13326
Out-of-bounds read and integer underflow vulnerability in QN -
CVE-2026-11573
Uncontrolled recursion in QDomDocument/QDomNode serializatio -
CVE-2026-15037
XML injection vulnerability in QDom comment, CDATA and proce -
CVE-2026-9499
Out-of-bounds read in QTextCodec::codecForName() in Qt
Same vendor: qt
-
CVE-2026-76151
Out-of-bounds read (buffer over-read) vulnerability in HTTP -
CVE-2026-13326
Out-of-bounds read and integer underflow vulnerability in QN -
CVE-2026-11573
Uncontrolled recursion in QDomDocument/QDomNode serializatio -
CVE-2026-15037
XML injection vulnerability in QDom comment, CDATA and proce -
CVE-2026-9499
Out-of-bounds read in QTextCodec::codecForName() in Qt
Same weakness: CWE-674
-
CVE-2026-12358
Security vulnerabilities have been addressed in IBM Verify I -
CVE-2026-91968
vikunja before 2.6.0 Denial of Service via unbounded filter -
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain le -
CVE-2026-90472
msgpack-java through 0.9.12 Stack Overflow via Nested Arrays -
CVE-2026-88763
Skupper-router: skupper-router: unbounded recursion in amqp
V. Comments for CVE-2026-19248
No comments yet