CVE-2026-114369
Description
A flaw was found in Qt. A remote attacker can cause a Denial of Service (DoS) through resource exhaustion within the QWebSocket and QWebSocketServer classes of the Qt WebSockets module. By triggering excessive resource consumption over the network without requiring authentication, an attacker can degrade application performance and impact service availability.
Statement
This vulnerability is rated as Moderate because although it can be triggered remotely by unauthenticated actors, the impact is limited to availability degradation via resource depletion without compromising data confidentiality or system integrity. In Red Hat Enterprise Linux, Qt WebSockets is an application library rather than a default-enabled network daemon, meaning exposure is limited to environments hosting custom or third-party applications that explicitly instantiate network-facing WebSocket endpoints. Systems that do not deploy exposed Qt-based network services remain unaffected.
Mitigation
Limit network exposure by configuring firewall rules to restrict access to the WebSocket port so that only trusted clients or internal subnets can connect.
For example, to remove public access and allow only a specific trusted subnet via firewalld (replace <PORT> and <TRUSTED_CIDR> with your environment settings):
firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CIDR>
firewall-cmd --reload
Alternatively, if Qt WebSockets is not required by any installed application, remove the packages:
dnf remove qt5-qtwebsockets qt6-qtwebsockets
Caveats: Restricting firewall ports prevents untrusted external clients from establishing WebSocket connections. Removing Qt WebSockets packages may uninstall dependent graphical or third-party applications.
Warning: Reloading firewalld with `firewall-cmd --reload` briefly resets active connection tracking, and removing packages will stop any services that depend on these libraries.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
