CVE-2026-76151— Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)
Quick assessment
Affected
qt qt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Qt 6.0.0 至 6.8.8 以及 6.9.0 至 6.11.1 版本中，Qt Group 的 Qt 中 QtNetwork 模块在解析 HTTP 响应中的 Cache-Control 响应头时存在越界读取（缓冲区长于实际内容/缓冲区过度读取）漏洞。该漏洞允许远程攻击者通过返回一个异常大的 Cache-Control 头值给使用 QNetworkAccessManager 的应用程序，导致拒绝服务（应用程序崩溃）。 该漏洞仅影响连接的客户端一侧，且 32 位构建不受影响；该越界访问为只读操作，不会导致信息泄露，
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76151
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)
Source: CVE Program / CVE List V5
Vulnerability Description
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:A
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-76151
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76151
请登录查看更多情报信息。
Other References for CVE-2026-76151 (1)
IV. Related Vulnerabilities
Same product: qt
-
CVE-2026-19248
Unbounded recursion vulnerability in the QDomNode destructor -
CVE-2026-13326
Out-of-bounds read and integer underflow vulnerability in QN -
CVE-2026-11573
Uncontrolled recursion in QDomDocument/QDomNode serializatio -
CVE-2026-15037
XML injection vulnerability in QDom comment, CDATA and proce -
CVE-2026-9499
Out-of-bounds read in QTextCodec::codecForName() in Qt
Same vendor: qt
-
CVE-2026-19248
Unbounded recursion vulnerability in the QDomNode destructor -
CVE-2026-13326
Out-of-bounds read and integer underflow vulnerability in QN -
CVE-2026-11573
Uncontrolled recursion in QDomDocument/QDomNode serializatio -
CVE-2026-15037
XML injection vulnerability in QDom comment, CDATA and proce -
CVE-2026-9499
Out-of-bounds read in QTextCodec::codecForName() in Qt
Same weakness: CWE-125
-
CVE-2026-92475
GPAC downloader.c wait_for_header_and_parse out-of-bounds -
CVE-2026-73462
On affected platforms running Arista EOS with IGMP (Internet -
CVE-2026-56719
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 Session -
CVE-2026-92255
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_ -
CVE-2026-76870
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write F
V. Comments for CVE-2026-76151
No comments yet