AZL-100947

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100947.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-100947
Upstream
  • CVE-2026-11573
Published
2026-09-08T13:17:17Z
Modified
2026-09-14T05:26:59Z
Summary
CVE-2026-11573 affecting package qtbase 6.6.3-5
Details

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

References

Affected packages

Azure Linux:3 / qtbase

Package

Name
qtbase
Purl
pkg:rpm/azure-linux/qtbase

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
6.6.3-5

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100947.json"