CVE-2026-76151

Executive Summary

CVE-2026-76151 is an out-of-bounds read (CWE-125) in the HTTP Cache-Control response header parsing logic within the QtNetwork module of the Qt framework. Applications built on affected 64-bit Qt builds that use QNetworkAccessManager to consume HTTP responses from untrusted or compromised servers can be crashed by a remote attacker supplying an excessively large Cache-Control header value, resulting in a client-side denial of service. The issue affects Qt 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1; the out-of-bounds access is read-only, with no information disclosure or code execution, and 32-bit builds are explicitly not affected.

Technical Analysis

The vulnerability resides in the HTTP response header parser for the Cache-Control header inside the QtNetwork module. When a QNetworkAccessManager client receives an HTTP response, the header value for Cache-Control is parsed to extract caching directives. In affected 64-bit builds, an excessively large header value drives the parser past the bounds of its allocated buffer, producing a read-only out-of-bounds access that can terminate the application process (crash).

Key technical characteristics, derived strictly from the available description:

• Weakness class: CWE-125 — Out-of-bounds Read. The parser reads memory beyond the end of the buffer holding the header value.
• Exploitation direction: Client-side only. The attack is delivered by a malicious or compromised HTTP server to a Qt-based client. The affected component is the HTTP client path (response header handling), not a server.
• Trigger: A single response containing an excessively large Cache-Control header value. No authentication or user interaction beyond the client issuing an HTTP request is described.
• Access impact: Read-only. The description explicitly states there is no information disclosure and no code execution, which constrains the impact to availability (process termination / crash).
• Architecture dependency: Only 64-bit builds are affected. The description states 32-bit builds are not affected, implying the out-of-bounds condition depends on 64-bit memory layout or size calculations specific to that build target.
• Public interface involved: QNetworkAccessManager — the standard Qt class used by applications for issuing network requests and processing replies.

The precise buffer allocation size, the parsing routine involved, and the exact boundary arithmetic are not disclosed in the available data. No function names beyond QNetworkAccessManager and no file paths are provided in the NVD description. Analysts should avoid inferring internal parser implementation details until a vendor patch or researcher write-up is published.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies systems or applications that: (a) run on 64-bit platforms, (b) are built against Qt 6.0.0–6.8.8 or 6.9.0–6.11.1, and (c) use QNetworkAccessManager to fetch HTTP resources from endpoints the attacker can influence. Candidate targets include desktop clients, embedded/IoT user interfaces, kiosk applications, and back-end services that parse untrusted HTTP responses via QtNetwork.

2. Delivery / positioning. The attacker controls, compromises, or can otherwise inject into an HTTP server that a Qt client will contact — for example, a malicious site, a hijacked endpoint, an on-path adversary, or a compromised content/CDN dependency. The attack is a server-side response to a client-initiated request.

3. Triggering the flaw (vulnerability-class level). Upon the client's HTTP request, the malicious server returns a response whose Cache-Control header value is excessively large — beyond what the affected parser handles safely on 64-bit builds. Processing this oversized value causes the out-of-bounds read in the header parsing routine. Since the access is read-only, the practical outcome is a crash of the requesting application (denial of service), not memory disclosure or control-flow hijack.

4. Post-exploitation impact. The attacker achieves an availability impact on the victim client: the Qt application terminates unexpectedly. In interactive applications this is a user-visible crash; in headless or embedded deployments it can translate to service interruption or repeated restart loops if the client automatically reconnects to the malicious endpoint. No confidentiality or integrity impact is described.

Note: No public PoC is available; attack chain is inferred from the vulnerability class. No specific internal function names, file paths, or crafted byte patterns can be provided without fabricating details, as none appear in the source data.

Impact Assessment

• Impact class: Availability only (denial of service via client application crash).
• CVSS-style subscores (inferred, not vendor-assigned): Availability: Low; Confidentiality: None; Integrity: None; Scope: Unchanged. A remote, network-reachable trigger with no authentication and no user interaction beyond normal client HTTP activity is consistent with AV:N/AC:L/PR:N/UI:N. Note that no official CVSS score or vector has been assigned; the vector above is an analyst-derived estimate and must not be represented as an authoritative score. EPSS has not been scored by FIRST.org and no value should be fabricated.
• Blast radius: Any 64-bit application or service embedding affected Qt versions and using QNetworkAccessManager to consume untrusted HTTP responses. This spans desktop software, embedded HMI/UI stacks, industrial and medical device interfaces, and any Qt-based client that talks to third-party or user-influenced HTTP endpoints.
• Repeatability: A malicious endpoint can crash the client on every request, enabling sustained denial of service. If the client retries automatically, denial can become continuous.
• Constraints reducing impact: Read-only access, no information disclosure, no code execution, and 32-bit builds unaffected. The practical damage is limited to disruption/instability of the client process rather than data compromise.

Detection Guidance

Sigma Rule

title: Qt QNetworkAccessManager Oversized Cache-Control Header DoS (CVE-2026-76151)
id: 9f8c3d21-7615-4cve-8a11-qt76151aa01
status: experimental
description: Detects abnormal process termination of Qt-based applications following HTTP responses with oversized Cache-Control headers, consistent with CVE-2026-76151 out-of-bounds read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76151
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_termination
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '.exe'
  selection_qt:
    Image|contains:
      - 'qt'
  selection_crash:
    EventID: 1000
  condition: selection_qt and selection_crash
fields:
  - Image
  - EventID
  - TargetObject
falsepositives:
  - Legitimate application crashes unrelated to network activity
  - Any Qt application faulting for other reasons
level: low

YARA Rule

rule CVE_2026_76151_Qt_CacheControl_OOB
{
    meta:
        description = "Identifies Qt binaries linked against affected QtNetwork versions"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76151"
        cve = "CVE-2026-76151"
        date = "2026-01-01"

    strings:
        $qt_net = "QNetworkAccessManager" ascii wide
        $cc = "Cache-Control" ascii wide
        $qnet = "Qt6Network" ascii

    condition:
        uint16(0) == 0x5A4D and
        any of ($qt_net, $qnet) and $cc
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76151 Qt Cache-Control Oversized Header DoS Attempt"; flow:established,to_client; http.header_names; content:"Cache-Control"; nocase; pcre:"/Cache-Control\x3a\s*[^\r\n]{4096,}/iH"; threshold: type both, track by_src, count 2, seconds 60; classtype:attempted-dos; reference:cve,2026-76151; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76151; sid:202676151; rev:1;)

Elastic Detection

process where event.type == "end" and process.executable != null and
  process.name : ("*.exe", "*") and
  (
    process.exit_code != 0 or
    process.command_line : "*qt*"
  ) and
  process.command_line != null

Splunk SPL Query

index=network sourcetype=http OR sourcetype=stream:http
| where len(Cache-Control) > 4096 OR len(cache_control) > 4096
| stats count values(Cache-Control) as headers by src_ip dest_ip uri
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="qt_cve_2026_76151,">
  <rule id="202676151" level="10">
    <decoded_as>json</decoded_as>
    <field name="Cache-Control">\.{4096,}</field>
    <description>CVE-2026-76151: Oversized HTTP Cache-Control header observed - possible Qt QNetworkAccessManager DoS attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,qtcve,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, fixed release, or patch source has been identified for CVE-2026-76151.

1. Immediate mitigations (no patch available):

   • Restrict outbound HTTP(S) from Qt-based clients to explicitly trusted endpoints where operationally feasible, reducing exposure to attacker-controlled or compromised servers.
   • Where a forward proxy or application-layer gateway can be inserted, drop or truncate HTTP responses containing Cache-Control values exceeding a defined maximum length (e.g., 4 KB) before they reach Qt clients.
   • Enable application crash monitoring and auto-restart controls to limit denial-of-service duration in headless/embedded deployments.
   • Track the client-side network paths (TLS inspection, DNS logging) for Qt applications contacting untrusted hosts.

2. Patch / upgrade steps: No fixed version is documented. Monitor the Qt Group security advisories and release notes for Qt 6.8.x and 6.9.x/6.11.x for a security fix referencing this issue. Once released, upgrade affected 64-bit deployments to the patched Qt version and rebuild dependent applications. Until then, treat all versions in the affected range as vulnerable.

3. Long-term hardening:

   • Implement robust header-length validation and bounds-checking in any first-party HTTP client wrappers layered on QtNetwork.
   • Adopt dependency governance that tracks Qt security advisories and pins to maintained LTS branches.
   • Standardize egress filtering to reduce reliance on untrusted remote servers for supply of HTTP content consumed by client software.

References

• NVD CVE Record: https://nvd.nist.gov/vuln/detail/CVE-2026-76151
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Qt Group security advisories (monitor for patch): https://www.qt.io/security
• FIRST EPSS (unscored at time of writing): https://www.first.org/epss/

Exploitation status: No public PoC, exploit code, or Nuclei template is available, and CVE-2026-76151 is not listed in CISA KEV. No threat actor campaigns or in-the-wild exploitation evidence has been identified.