CVE-2023-38197 Denial of service in n/a
Attackers can cause denial of service via infinite loops in recursive entity expansion within the Qt framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38197?
CVE-2023-38197 is a high-severity denial of service vulnerability in Qt Qt, published on 13 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
Weakness: CWE-835
Which versions are affected by CVE-2023-38197?
It affects 1 product.
Linux distribution packages (2)
libqt5-qtbase openSUSE:Tumbleweed | All versions | 5.15.11+kde138-2.1 |
qt6-base openSUSE:Tumbleweed | All versions | 6.5.2-1.1 |
Products include Qt Qt.
How do I fix CVE-2023-38197?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38197 being exploited?
There is no known exploitation of CVE-2023-38197 in the wild and no public exploit code.
Other vulnerabilities in Qt Qt
Sources
Also known as AZL-27652, CLSA-2025-1764026530, DEBIAN-CVE-2023-38197, GHSA-98w5-63h7-29q8, UBUNTU-CVE-2023-38197, openSUSE-SU-2024:13079-1 and 1 more.