{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "qt: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/qt--qt/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/qt--qt/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-95620/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-95620/",
   "title": "CVE-2026-95620 disclosed",
   "content_text": "A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.",
   "date_published": "2026-10-23T10:56:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16762/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16762/",
   "title": "CVE-2026-16762 disclosed",
   "content_text": "An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.",
   "date_published": "2026-10-23T08:58:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16762/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16762/",
   "title": "CVE-2026-16762 fixed in Debian:14",
   "content_text": "Fixed versions: qt6-base 6.11.2+dfsg-5.",
   "date_published": "2026-10-23T08:58:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105923/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105923/",
   "title": "CVE-2026-105923 disclosed",
   "content_text": "A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.",
   "date_published": "2026-10-21T09:21:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101201/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101201/",
   "title": "CVE-2026-101201 disclosed",
   "content_text": "A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.",
   "date_published": "2026-10-20T08:20:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8168/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8168/",
   "title": "CVE-2026-8168 disclosed",
   "content_text": "Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.",
   "date_published": "2026-10-19T13:08:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8168/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8168/",
   "title": "CVE-2026-8168 fixed in Debian:14",
   "content_text": "Fixed versions: qt6-svg 6.11.2-2.",
   "date_published": "2026-10-19T13:08:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8168/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8168/",
   "title": "CVE-2026-8168 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: qt6 0:6.11.2-1.1.hum1, qt6-filesystem 0:6.11.2-1.1.hum1, qt6-rpm-macros 0:6.11.2-1.1.hum1, qt6-srpm-macros 0:6.11.2-1.1.hum1.",
   "date_published": "2026-10-19T13:08:14Z"
  }
 ]
}