CVE-2026-96432

LowCVSS 2.1

Published: 26/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Risk Assessment

A null pointer dereference causes an application crash, potentially leading to denial of service (DoS) for clients connecting to a malicious HTTP/2 server.

Recommendation

Update Qt to a version containing the fix and avoid connecting to untrusted HTTP/2 servers until updated.

Other vulnerabilities in Qt Network

CVE-2026-95620Low
A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.

Original NVD description (English source)

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS