CVE-2026-11573

Deferred Deferred - Pending Action

Uncontrolled Recursion in QtXml Causes DoS via Stack Exhaustion

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: TQtC

Description

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-11573

Affected Vendors & Products

Vendor	Product	Version / Range
qt	qtxml	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled recursion in Qt's QDomDocument serialization (QtXml) which allows deeply nested untrusted XML to crash applications by exhausting the stack, leading to a denial of service (DoS).

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or hangs in applications using QtXml's QDomDocument during XML processing. Check logs for stack overflow errors or application timeouts when handling XML files. No specific commands are provided for detection.

Impact Analysis

An attacker could exploit this by providing maliciously crafted XML data to crash your application, disrupting service and potentially causing downtime or loss of functionality.

Mitigation Strategies

Apply patches or updates from Qt to fix the uncontrolled recursion issue in QDomDocument. Limit XML input size and complexity in applications using QtXml. Use XML parsers with stack-safe implementations if possible.

Hi! I’m here to help you understand CVE-2026-11573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70