Vulnerability record/PUBLISHED/Published Oct 26, 2026 11:31:20 UTC
CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.
Base score2.1/ 10
SeverityLowCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredNonePR
User interactionActiveUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
Exploit maturityUnprovenE
AutomatableNoAU
RecoveryUserR
Response effortLowRE
Provider urgencyGreenU
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:GreenCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityQt
Last updatedOct 26, 2026 11:31:20 UTC
PublishedOct 26, 2026 11:31:20 UTC
ReservedSep 23, 2026 06:49:22 UTC
Credits
- Daniel Birtwhistle