CVE-2026-11573

A flaw was found in qtbase. Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) allows a remote attacker to provide deeply nested untrusted XML, leading to stack exhaustion. This can cause the application to crash, resulting in a Denial of Service (DoS).

Red Hat has rated this vulnerability as Important because unauthenticated remote attackers can trigger an immediate denial of service against applications that serialize untrusted XML input. Applications employing the QtXml module to handle and serialize document structures can experience unbounded call recursion when handling deeply nested elements, terminating the process via stack exhaustion. The blast radius is confined to service availability, with no risk of arbitrary code execution or confidentiality compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications that use Qt's QDomDocument for XML serialization should avoid processing untrusted XML input. If processing untrusted XML is unavoidable, implement robust input validation and sanitization to prevent deeply nested structures before passing the data to the QtXml component. This requires application-level changes or careful operational procedures to ensure only trusted XML is processed.