CVE-2026-11573 Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

Q: Is CVE-2026-11573 being exploited?

There is no known exploitation of CVE-2026-11573 in the wild and no public exploit code.

High 7.1 Published 8 Sep 2026 Updated 11 Sep 2026

Attackers can cause application crashes via stack exhaustion by providing deeply nested XML documents to the Qt XML module for serialization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-11573?

CVE-2026-11573 is a high-severity denial of service vulnerability in qt, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Weakness: CWE-674

Which versions are affected by CVE-2026-11573?

Linux distribution packages (30)

`qt6-qtbase` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-common` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-debugsource` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-devel` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-devel-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-examples` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-examples-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-gui` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-gui-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-mysql` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-mysql-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-odbc` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-odbc-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-postgresql` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-postgresql-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-private-devel` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-static` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase-tests-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:6.8.1-9.el10_0.1`
`qt6-qtbase` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-common` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-devel` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-examples` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-gui` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-ibase` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-mysql` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-odbc` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-postgresql` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-private-devel` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`
`qt6-qtbase-static` Red Hat:hummingbird:1	All versions	`0:6.11.2-3.hum1`

How do I fix CVE-2026-11573?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-11573 being exploited?