Описание
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.
If the function was called with malformed data, for example, an URL that
contained a "charset" parameter that lacked a value (such as
"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service
(abort).
This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
A flaw was found in QtCore's qDecodeDataUrl() function. This vulnerability allows an application level denial of service via a malformed data URL with a missing charset value when assertions are enabled.
Отчет
A moderate severity denial-of-service flaw was found in the private qDecodeDataUrl() function in QtCore, which is used by QTextDocument and QNetworkReply and potentially by application code. If an application built with assertions enabled processes a malformed data URL, for example one whose "charset" parameter lacks a value (such as "data:charset,"), the function hits an assertion and the application aborts. Confidentiality and integrity are not affected. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) because it only affects availability and only manifests when Qt is built with assertions enabled, which is typically the case only for debug builds; the upstream CVE.org record assigns a higher CVSS 4.0 score of 8.4. The affected components are qt5-qtbase and qt6-qtbase in Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 1, and Fedora and EPEL community streams; all currently listed product streams are affected. For Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and the community streams, a fix is being pursued through the responsible maintainers. For Red Hat Enterprise Linux 7 ELS, Red Hat Enterprise Linux 8, and Red Hat In-Vehicle OS 1, the fix is deferred because this is a moderate, availability-only issue in maintenance-phase streams and triggering it requires an application built with assertions enabled to process malformed data URLs; the residual risk is that such applications can be crashed by untrusted input.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | qt5-qtbase | Fix deferred | ||
| Red Hat Enterprise Linux 8 | qt5-qtbase | Fix deferred | ||
| Red Hat Enterprise Linux 10 | qt6-qtbase | Fixed | RHSA-2025:9486 | 24.06.2025 |
| Red Hat Enterprise Linux 9 | qt5-qtbase | Fixed | RHSA-2025:9462 | 24.06.2025 |
| Red Hat Enterprise Linux 9.4 Extended Update Support | qt5-qtbase | Fixed | RHSA-2025:11841 | 28.07.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
Possible denial of service when passing malformed data in a URL to qDecodeDataUrl
An issue was found in the private API function qDecodeDataUrl() in QtC ...
EPSS
5.3 Medium
CVSS3