CVE-2025-6338

CriticalCVSS 9.2/10Last modified Oct 9, 2026

Description

There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.

This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.

Metrics

CVSS 4.0 9.2/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-459

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2025
Last modified
Oct 9, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-633846.5A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruCVE-2025-633869.1A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpointCVE-2025-633877.5Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/systeCVE-2025-633889.1A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. ThCVE-2025-633899.8A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The plaCVE-2025-63399.8A vulnerability was found in ponaravindb Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknoCVE-2025-633905.3An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proCVE-2025-633963.3An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or CVE-2025-633976.5Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code dCVE-2025-63405.4A vulnerability classified as problematic has been found in code-projects School Fees Payment System 1.0. This affects an unknown part of thCVE-2025-634015.5Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary cCVE-2025-634025.5An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforc
CVE-2025-6338: Critical severity, CVSS 9.2 | Vulnix