Qt Network module patched for use-after-free vulnerability in HTTP/2
Qt has released patches for versions 6.11.3 and 6.12.0 to address a use-after-free vulnerability in the QNetworkAccessManager HTTP/2 implementation.
CVE-2026-95620 is a use-after-free vulnerability in the HTTP/2 client support of QNetworkAccessManager within the Qt Network module. Published on October 23, 2026, the issue lets a malicious or compromised HTTP/2 server crash a client application.
The flaw hits Qt versions 6.9.0 through 6.11.2. The CVSS 4.0 score is 2.1, rating it Low. The CVSS vector lists a network attack vector, high attack complexity, required attack requirement, user interaction, zero impact on confidentiality or integrity, and high impact on availability.
Fixes land in Qt 6.11.3 and 6.12.0 or later. If you build from source, you can apply patches released for the dev and 6.11 branches, with the 6.11 patch also provided as a downloadable diff file.
Need an immediate workaround? Disable HTTP/2 for affected requests by calling QNetworkRequest::setAttribute(QNetworkRequest::Http2AllowedAttribute, false) so requests fall back to other protocols.
Daniel Birtwhistle discovered, reported, and helped verify the fix. Additional recent security notices include CVE-2026-96432 for a null pointer dereference in QNetworkAccessManager, and CVE-2026-16762 for a denial-of-service issue in the QXmlStreamReader parser inside Qt Core.