CVE-2025-5455

A moderate severity denial-of-service flaw was found in the private qDecodeDataUrl() function in QtCore, which is used by QTextDocument and QNetworkReply and potentially by application code. If an application built with assertions enabled processes a malformed data URL, for example one whose "charset" parameter lacks a value (such as "data:charset,"), the function hits an assertion and the application aborts. Confidentiality and integrity are not affected. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) because it only affects availability and only manifests when Qt is built with assertions enabled, which is typically the case only for debug builds; the upstream CVE.org record assigns a higher CVSS 4.0 score of 8.4.

The affected components are qt5-qtbase and qt6-qtbase in Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 1, and Fedora and EPEL community streams; all currently listed product streams are affected. For Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and the community streams, a fix is being pursued through the responsible maintainers. For Red Hat Enterprise Linux 7 ELS, Red Hat Enterprise Linux 8, and Red Hat In-Vehicle OS 1, the fix is deferred because this is a moderate, availability-only issue in maintenance-phase streams and triggering it requires an application built with assertions enabled to process malformed data URLs; the residual risk is that such applications can be crashed by untrusted input.