CVE-2026-76151

A flaw was found in the QtNetwork module of the Qt Framework. This out-of-bounds read vulnerability allows a remote attacker to cause a denial of service (application crash). This occurs when an application using QNetworkAccessManager processes an excessively large HTTP Cache-Control header value from an untrusted or compromised server. The vulnerability affects only the client side of the connection and results in read-only access, with no information disclosure or code execution.

Red Hat has evaluated this vulnerability as having an Important severity because an unauthenticated remote server can trigger an immediate application termination by returning an oversized response header, requiring no local privileges. Client software utilizing the Qt 6 networking stack to retrieve web resources is susceptible to crashes when handling malicious caching directives. Red Hat Enterprise Linux 8 and 9 provide Qt 5, which does not contain the affected code and is therefore not vulnerable. Furthermore, this defect is restricted to read-only memory operations and does not facilitate data leakage or code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.