CVE-2026-95620

LowCVSS 2.1

Published: 23/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.

Risk Assessment

A malicious HTTP/2 server can crash the client application, causing service disruption and loss of availability.

Recommendation

Update Qt to a patched version and consider restricting HTTP/2 connections to trusted servers.

Other vulnerabilities in Qt Network

CVE-2026-96432Low
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS