{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "qt: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/qt--qt/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/qt--qt/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16762/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16762/",
   "title": "CVE-2026-16762 disclosed",
   "content_text": "An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.",
   "date_published": "2026-10-23T08:58:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16762/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16762/",
   "title": "CVE-2026-16762 fixed in Debian:14",
   "content_text": "Fixed versions: qt6-base 6.11.2+dfsg-5.",
   "date_published": "2026-10-23T08:58:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8168/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8168/",
   "title": "CVE-2026-8168 disclosed",
   "content_text": "Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.",
   "date_published": "2026-10-19T13:08:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8168/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8168/",
   "title": "CVE-2026-8168 fixed in Debian:14",
   "content_text": "Fixed versions: qt6-svg 6.11.2-2.",
   "date_published": "2026-10-19T13:08:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-8168/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-8168/",
   "title": "CVE-2026-8168 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: qt6 0:6.11.2-1.1.hum1, qt6-filesystem 0:6.11.2-1.1.hum1, qt6-rpm-macros 0:6.11.2-1.1.hum1, qt6-srpm-macros 0:6.11.2-1.1.hum1.",
   "date_published": "2026-10-19T13:08:14Z"
  }
 ]
}