---
id: CVE-2025-5991
title: >-
  There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the
  QtNetwork module
summary: >-
  There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the
  QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not
  affected by this at all. This happens due to a race condition between how
  QHttp2Stre…
severity: none
cwe:
  - CWE-416
published: '2025-06-11'
updated: '2026-07-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5991'
references:
  - url: 'https://codereview.qt-project.org/c/qt/qtbase/+/643777'
    label: a59d8014-47c4-4630-ab43-e1b13cbe58e3
tags:
  - nvd
epss: 0.00136
epssPercentile: 0.02451
ingestedAt: '2026-07-29T10:45:50.306Z'
---

## Overview

There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not affected by this at all. This happens due to a race condition between how QHttp2Stream uploads the body of a
 POST request and the simultaneous handling of HTTP error responses.



This issue only affects Qt 6.9.0 and has been fixed for Qt 6.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.