CVE catalog

CVE-2026-96432

qt6-base: CVE-2026-96432

Severity: Medium
Published: Oct 26, 2026, 12:17:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.33% · Oct 27, 2026

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	qt6-base	sid	`6.11.2+dfsg-7`	vulnerable
Debian	qt6-base	forky	`6.11.2+dfsg-5`	vulnerable
Debian	qt6-base	trixie	`6.8.2+dfsg-9+deb13u2`	vulnerable
Debian	qt6-base	bookworm	`6.4.2+dfsg-10`	vulnerable
Ubuntu	qt6-base	22.04	`6.2.2+dfsg-5ubuntu1`	vulnerable
Ubuntu	qt6-base	22.04	`6.2.2+dfsg-6ubuntu1`	vulnerable
Ubuntu	qt6-base	22.04	`6.2.2+dfsg-6ubuntu2`	vulnerable
Ubuntu	qt6-base	22.04	`6.2.4+dfsg-1ubuntu1`	vulnerable
Ubuntu	qt6-base	22.04	`6.2.4+dfsg-2ubuntu1`	vulnerable
Ubuntu	qt6-base	22.04	`6.2.4+dfsg-2ubuntu1.1`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-18`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-19`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-19build1`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-20`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-21`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-21.1build4`	vulnerable
Ubuntu	qt6-base	24.04	`6.4.2+dfsg-21.1build5`	vulnerable
Ubuntu	qt6-base	26.10	`6.10.2+dfsg-7`	vulnerable
Ubuntu	qt6-base	26.10	`6.10.2+dfsg-14ubuntu2`	vulnerable
Ubuntu	qt6-base	26.10	`6.10.2+dfsg-15`	vulnerable
Ubuntu	qt6-base	26.10	`6.10.2+dfsg-16`	vulnerable
Ubuntu	qt6-base	26.10	`6.11.2+dfsg-4ubuntu2`	vulnerable
Ubuntu	qt6-base	26.04	`6.9.2+dfsg-1ubuntu1`	vulnerable
Ubuntu	qt6-base	26.04	`6.9.2+dfsg-2`	vulnerable
Ubuntu	qt6-base	26.04	`6.9.2+dfsg-3ubuntu1`	vulnerable
Ubuntu	qt6-base	26.04	`6.9.2+dfsg-3ubuntu2`	vulnerable
Ubuntu	qt6-base	26.04	`6.9.2+dfsg-4`	vulnerable
Ubuntu	qt6-base	26.04	`6.10.2+dfsg-3`	vulnerable
Ubuntu	qt6-base	26.04	`6.10.2+dfsg-6`	vulnerable
Ubuntu	qt6-base	26.04	`6.10.2+dfsg-7`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	qt6-base	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	qt6-base	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	qt6-base	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	qt6-base	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libqt6concurrent6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6core6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6dbus6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6gui6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6network6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6opengl6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6opengl6-dev]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6openglwidgets6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6printsupport6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6sql6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6sql6-ibase]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6sql6-mysql]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6sql6-odbc]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6sql6-psql]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6sql6-sqlite]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6test6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6widgets6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6xml6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[qmake6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[qmake6-bin]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12

Next results

Observed: Oct 28, 2026, 2:25:06 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]