CVE-2026-76151 qt CVE debrief

Who should care

Defenders responsible for Qt-based applications should assess exposure and prioritize updates to patched versions if necessary. This includes reviewing affected Qt versions, monitoring for large Cache-Control header values, and verifying compensating controls. Security teams and vulnerability management teams should also review the vulnerability and plan for remediation.

Why it matters

CVE-2026-76151 is a medium-severity vulnerability in Qt Group Qt that allows remote attackers to cause a denial of service. Defenders should prioritize verifying affected Qt versions and updating to patched versions if necessary.

• Denial of service via application crash
• Verification of affected Qt versions required
• Potential for service disruption

Technical summary

The vulnerability is an out-of-bounds read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1. It allows remote attackers to cause a denial of service via an excessively large Cache-Control header value. The out-of-bounds access is read-only, with no information disclosure and no code execution. Only the client side of the connection is affected and 32-bit builds are not affected. Defenders should prioritize verifying affected Qt versions and updating to patched versions if necessary.

Defensive priority

Defenders should prioritize verifying affected Qt versions and updating to patched versions if necessary.

Recommended defensive actions

• Verify affected Qt versions in use
• Update to patched Qt versions if necessary
• Monitor for large Cache-Control header values
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described as an out-of-bounds read in the HTTP Cache-Control response header parsing in the QtNetwork module. The CVE record and NVD detail page provide official information on the vulnerability. Evidence limits are based on CVE and NVD details. Defenders should verify affected Qt versions and review official advisories for further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.