This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-19248 →

DEBIAN-CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

Original description

The description as published by the source.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Debian:12 qt6-base

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 qt6-base

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 qt6-base

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2+dfsg-5"}]}]

Debian:12 qtbase-opensource-src

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 qtbase-opensource-src

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 qtbase-opensource-src

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.19+dfsg-5"}]}]