CVE-2026-110944

LowCVSS 2.7/10Last modified Nov 6, 2026

Description

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.

Metrics

CVSS 4.0 2.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
qtQt Framework>= 6.4.0, < 6.11.3; >= 6.12.0, < 6.12.1

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1109483.7The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is alloweCVE-2026-1109493.7The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured rCVE-2026-110959.6Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised tCVE-2026-1109517.5Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper TeCVE-2026-1109525.9A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, bCVE-2026-1109559.8The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers tCVE-2026-1109569.8The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, tCVE-2026-11095710.0A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file apiCVE-2026-11095810.0A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulCVE-2026-1109599.8The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, acceptCVE-2026-110966.5Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fCVE-2026-1109639.8The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and
CVE-2026-110944: Low severity, CVSS 2.7 | Vulnix