Red Hat Product Errata RHSA-2026:99746 - Security Advisory
Issued:
2026-11-12
Updated:
2026-11-12

RHSA-2026:99746 - Security Advisory

Synopsis

Important: qt5-qtbase security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

  • qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
  • qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2529762 - CVE-2026-11573 qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization
  • BZ - 2535011 - CVE-2026-19248 qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
qt5-qtbase-5.9.7-6.el7_9.1.src.rpm SHA-256: 033bc19e1b6ed130c936539ede75c3186be96cf1d1f0c7e3b373e5ed3e322f41
x86_64
qt5-qtbase-5.9.7-6.el7_9.1.i686.rpm SHA-256: c7782042c307362695a7e2a21bc7d9d3f2c28b8754d396fd3d9bdcc1f259db23
qt5-qtbase-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: fa636eb7d3da23f3e597136ebf723d77fed74723ba40505dd43005a1d8f67d94
qt5-qtbase-common-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 4fd58a7079424b3c4f9c914927236e386394662af162acbea96b80ae96afaacc
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.i686.rpm SHA-256: 6a0d360f259e90ee765f9a6720b8b61ccdcc00925ac06e00fa2d6a9916cdf3f3
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.i686.rpm SHA-256: 6a0d360f259e90ee765f9a6720b8b61ccdcc00925ac06e00fa2d6a9916cdf3f3
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: 40b11fa1511e174d16803930e038905346d66e1767d290458e70986715a89dfe
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: 40b11fa1511e174d16803930e038905346d66e1767d290458e70986715a89dfe
qt5-qtbase-devel-5.9.7-6.el7_9.1.i686.rpm SHA-256: 0a98e24154d5be11afa670385aba5d8178eda2fb45f29f6452d3b5aff6f50868
qt5-qtbase-devel-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: e782bc540487ca4617f1da0ed1259433e04b07b9b911e1031b97070f3abd3215
qt5-qtbase-doc-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: 70c1a528eabfccf5f77bee1d2f6df702c73ceb693d8b8c370395f13b64dbf380
qt5-qtbase-examples-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: 9ccfc6ced782bbd298b9a4860e34905367b3b1ed148dfff0f02b55db516a9f3d
qt5-qtbase-gui-5.9.7-6.el7_9.1.i686.rpm SHA-256: 1251e05c46f975e046b201e7b62c41c89c2e6a0ab6f484ac93b7227f342ac804
qt5-qtbase-gui-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: 6d53c19fbe1db7e96968ef8f3c3199372102c926f0dae91e66380904489b4041
qt5-qtbase-mysql-5.9.7-6.el7_9.1.i686.rpm SHA-256: e60012255fb11582d6861307f55bf20dd9e7b965e953b478484b1fd8757c3d04
qt5-qtbase-mysql-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: d70292e3f929a9d693de4dbb21a313f1c8d2222a883429345e95640d95055ad3
qt5-qtbase-odbc-5.9.7-6.el7_9.1.i686.rpm SHA-256: 028f6167323a013662bd13acffcf5937bb8dcefda65726d33bd926f8d2e45b81
qt5-qtbase-odbc-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: d1891e5a6ee7ba51751e06f7b60e98c3572e8cf7c870e8d0c1caab53874d02db
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.i686.rpm SHA-256: b1d1a9e3aeae23f66f6a685510e855621b3e62223e0c2f079c2c7b856e3febaf
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: d5ccea48702c5f25c0fdfea8112605e0bc08264f910e2562978871cbfe7e017c
qt5-qtbase-static-5.9.7-6.el7_9.1.i686.rpm SHA-256: 02df296989daeef5b6d15dfa6624e21bd8affaf2d64b43e8a8cd89a5e667c715
qt5-qtbase-static-5.9.7-6.el7_9.1.x86_64.rpm SHA-256: c9067d24d1eb061766a5f6ce587763593a12b9189386f9da063a38c54b4b3968
qt5-rpm-macros-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 721d955c351fc251bc776e1c7a9f8e9340db2c18779a0f64b519fb3830ae127a

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
qt5-qtbase-5.9.7-6.el7_9.1.src.rpm SHA-256: 033bc19e1b6ed130c936539ede75c3186be96cf1d1f0c7e3b373e5ed3e322f41
s390x
qt5-qtbase-5.9.7-6.el7_9.1.s390.rpm SHA-256: 2fcb3dee8debfb635ffb8d83bf488c9502b6508e31bea72a0b1a57bad557f08a
qt5-qtbase-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 54a411f7f881117b8bcbf4a154911b1bbf1f910ce86add881dc4ff96c8dc32f4
qt5-qtbase-common-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 4fd58a7079424b3c4f9c914927236e386394662af162acbea96b80ae96afaacc
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.s390.rpm SHA-256: 6bfc1ca91332501585c89c97ec996f46f2ac4b108b12add5997811cd4052bcbe
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.s390.rpm SHA-256: 6bfc1ca91332501585c89c97ec996f46f2ac4b108b12add5997811cd4052bcbe
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 95c750ff4db85ef1510fcb37a1f5828909de911de8c059aa0b9badbc6435572a
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 95c750ff4db85ef1510fcb37a1f5828909de911de8c059aa0b9badbc6435572a
qt5-qtbase-devel-5.9.7-6.el7_9.1.s390.rpm SHA-256: e8e01123eed514d101cdb63b6681a09108ebde2e678f2002680dc860e0cdc0ef
qt5-qtbase-devel-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 4c7fd2d1bef81cda335f075a0187d274c6e2033c56c7c3de5ba52ee200b1f761
qt5-qtbase-doc-5.9.7-6.el7_9.1.s390x.rpm SHA-256: a02c06a37ffc60aeccb8f91ad08a738f5a78312cf0df7e0008a32e420e28bf72
qt5-qtbase-examples-5.9.7-6.el7_9.1.s390x.rpm SHA-256: be3a653a6a8df227859670334fe26e27fb0a9109276dab84b778c362b3953480
qt5-qtbase-gui-5.9.7-6.el7_9.1.s390.rpm SHA-256: 9b22c72473c654898b9ad93b3c4954e9544026fb4d325e85289e745a85dc70a4
qt5-qtbase-gui-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 4eabbf16e1d94d960599f9f42632ac85ac267145d96505f1ab7a986aa7c298d6
qt5-qtbase-mysql-5.9.7-6.el7_9.1.s390.rpm SHA-256: 954a5b2bda5ce70d38f8ea858fadc40264d1d3a44b7a85c5be1c332fd8a3c7bd
qt5-qtbase-mysql-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 907d783a373e7ec2c853aa3261ad04d5a6da63696c5f46d6803ff8cd75edb053
qt5-qtbase-odbc-5.9.7-6.el7_9.1.s390.rpm SHA-256: dd3343c184c671627f4bb5417ce2880460f7738d26bbc059b070b0f13b880928
qt5-qtbase-odbc-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 3d0d19b1488aa73708e6faa88a3a19ca4191778e4c70a068a28ed974bc00d2c9
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.s390.rpm SHA-256: 9e0698af44f4f4b1efc41a63428a4baa2a36ebd3109a3a2d55ceea514c6bb026
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 9265c79cc64598a6f153855ad7cc29cadea4fbfef538fc46685221948c5e4b83
qt5-qtbase-static-5.9.7-6.el7_9.1.s390.rpm SHA-256: cdfd8836aac7a5847a14d91f4cb8f295021f0042846fc4cab4c78aadaaa8ecdb
qt5-qtbase-static-5.9.7-6.el7_9.1.s390x.rpm SHA-256: 373f1b051142c461742182b97590b2d1b81ad437da1d17a5554d862194c32d2c
qt5-rpm-macros-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 721d955c351fc251bc776e1c7a9f8e9340db2c18779a0f64b519fb3830ae127a

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
qt5-qtbase-5.9.7-6.el7_9.1.src.rpm SHA-256: 033bc19e1b6ed130c936539ede75c3186be96cf1d1f0c7e3b373e5ed3e322f41
ppc64
qt5-qtbase-5.9.7-6.el7_9.1.ppc.rpm SHA-256: e1ba7d3514f8c5085a7fc9c1215bfa38299bdc12517d6df7567573e8a692eb62
qt5-qtbase-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: 99e805857e7ae1b0d666af006f9d179705a174392080f5f0ba01225e4ce4b129
qt5-qtbase-common-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 4fd58a7079424b3c4f9c914927236e386394662af162acbea96b80ae96afaacc
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.ppc.rpm SHA-256: 2e598e97f9054aa9194b593c86d8969c3283e10b981f241522fb7029a2d75ff6
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.ppc.rpm SHA-256: 2e598e97f9054aa9194b593c86d8969c3283e10b981f241522fb7029a2d75ff6
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: cffa6b5d692ace9ce57a185370f1784f0948ebc0310656594e1d9f22d1c41054
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: cffa6b5d692ace9ce57a185370f1784f0948ebc0310656594e1d9f22d1c41054
qt5-qtbase-devel-5.9.7-6.el7_9.1.ppc.rpm SHA-256: 995a61f650e4ecd56cf978803a9735c45bf117e6264670d113e6b087a302358c
qt5-qtbase-devel-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: 1e060cdba2909dfc9a48f0e4b894b179568be143eae689db01def5d29c7e08a2
qt5-qtbase-doc-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: 147a0da5d4488d2d60d59967f129854f8392b2009b1a410b901c448a7c57dbdd
qt5-qtbase-examples-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: aa569f7987c18b8bbefc3b0deac87359f57319bccc1790c1292d7b545c18239b
qt5-qtbase-gui-5.9.7-6.el7_9.1.ppc.rpm SHA-256: c91303fe82509aee2bd5976438749714b06da4236c69873716262b460a3b79ca
qt5-qtbase-gui-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: 4d3223957f5f29e8663d622d65d79616b0800c0038c689267a82b7f58c88e3f5
qt5-qtbase-mysql-5.9.7-6.el7_9.1.ppc.rpm SHA-256: 7fcab037d4a7144b6a242d7d485a3271ff6eaccadad1d40c4ed4eb37e4a88e71
qt5-qtbase-mysql-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: edd6ade4f4c0c7780e66a95e4d89ce17cf2a4a4d304eda68775b6970069a5e5d
qt5-qtbase-odbc-5.9.7-6.el7_9.1.ppc.rpm SHA-256: 45e2eadd2cd136cb81df2c1aca0091850481365085d5a5b6dece667706e86cd8
qt5-qtbase-odbc-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: 6da977b5c7284373ac3ce88765d44b15f29347f7a1ac00a6a8b864acf765d985
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.ppc.rpm SHA-256: 20f14dbfeeac1275868e61824459f5ea54083adf3fa798eae1ed8a56b6b31dc8
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: b157b3f14575f5c33cda3f73dd6bf241de55b0352c2beac2dc877fefb4960464
qt5-qtbase-static-5.9.7-6.el7_9.1.ppc.rpm SHA-256: e94c7bd894d1519a70eaf20bc229713190c4f3c284ce926f956071d9040d72fd
qt5-qtbase-static-5.9.7-6.el7_9.1.ppc64.rpm SHA-256: 72bf26c8d1010104b11dcc573c4300f03069946c7175102643348c8f8e63e5f8
qt5-rpm-macros-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 721d955c351fc251bc776e1c7a9f8e9340db2c18779a0f64b519fb3830ae127a

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
qt5-qtbase-5.9.7-6.el7_9.1.src.rpm SHA-256: 033bc19e1b6ed130c936539ede75c3186be96cf1d1f0c7e3b373e5ed3e322f41
ppc64le
qt5-qtbase-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: 199eb101013ff0349e267ddcfb73a994db8ae4faaecf31513a8aa3b8829bea4c
qt5-qtbase-common-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 4fd58a7079424b3c4f9c914927236e386394662af162acbea96b80ae96afaacc
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: b2c6ed722f3a27121923d6102c809344168763dfe9f7207166b0f16f07faa266
qt5-qtbase-debuginfo-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: b2c6ed722f3a27121923d6102c809344168763dfe9f7207166b0f16f07faa266
qt5-qtbase-devel-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: d0983fb2cd34af372f9b2ab2eb29bba1dc647618eaf21bed4a547f094c6d4088
qt5-qtbase-doc-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: 27e5a23d48df3ceacf51cc82e44e08fb4f2cc98d2dfffd0f34f773fdbaf9bc09
qt5-qtbase-examples-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: e536e33cdbc11f4ddbda1929b5961a1944374a3db9b6d0cb5c683ae6eb47cc28
qt5-qtbase-gui-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: 140a41dbac3a96d428a054ad90a9e8f61c319ed6efeb6c404b248ff91a5b3379
qt5-qtbase-mysql-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: a515d926f0df9d28a005dd016d00f3c97517a8c9c18b039f15c92a96ddb941dc
qt5-qtbase-odbc-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: f846c6fbc57db6e32e33ce658dad1ae6e7f95dd9f8a30a6078934326f01444c3
qt5-qtbase-postgresql-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: 06b86ef856f5ceb7d30872213392291e2a0dd2cb423df5833210cf3701ec6329
qt5-qtbase-static-5.9.7-6.el7_9.1.ppc64le.rpm SHA-256: abaaac1399bd8ffbfad550cef591a28c833ba9478b7af8e9339e5d1a402b7b79
qt5-rpm-macros-5.9.7-6.el7_9.1.noarch.rpm SHA-256: 721d955c351fc251bc776e1c7a9f8e9340db2c18779a0f64b519fb3830ae127a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.