{"id":"CVE-2026-11573","title":"Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase)","summary":"Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of elemen…","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-674","CWE-776"],"vendor":"qt","product":"qt","affected":["qt >= 2.2.0 < 6.8.2"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T10:16:50.500","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11573","references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/606899","label":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11573.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-11573"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529762"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11573"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11573"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T13:43:04.701549Z"},"cvssSource":"cna","epss":0.00387,"epssPercentile":0.32511,"scores":{"cna":7.1,"vendor":7.5},"ingestedAt":"2026-09-08T15:33:26.983Z","slug":"CVE-2026-11573","body":"## Overview\n\nUncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11573.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}