Use-after-free crash in Qt QNetworkAccessManager HTTP/2 client support

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.

• Qt qtbase and the Qt Network module: affected from Qt 6.9.0 through the releases before Qt 6.11.3, corresponding to Qt 6.9.0 through Qt 6.11.2.
• Fixed releases: Qt 6.11.3 and Qt 6.12.0.
• Before Qt 6.9.0: the CNA structured record marks the status as unknown, so the available evidence does not establish whether those releases are affected or unaffected.
• The product default status is unaffected, but the explicit status for the pre-Qt 6.9.0 range remains unknown.

The flaw is a CWE-416 Use After Free in the HTTP/2 client support of QNetworkAccessManager, part of the Qt Network module and qtbase package. A malicious or compromised HTTP/2 server can provide input that causes the client application to use memory after it has been released. Exploitation requires an application to act as an HTTP/2 client and connect to a server controlled by or compromised by an attacker; the record also classifies the attack requirement as present and the attack complexity as high. The record indicates that no privileges are required, but classifies user interaction as active, so an application or user action must cause the relevant client connection or response processing. The precise HTTP/2 sequence, freed object, and lifetime transition that trigger the flaw are not described in the evidence reviewed.

The vulnerability is remotely reachable when a Qt application connects to a malicious or compromised HTTP/2 server. The record classifies privileges as not required, attack complexity as high, attack requirements as present, and user interaction as active. A successful trigger can crash the client application, but the available evidence confirms only an availability effect. The record does not report a known exploitation status or public exploit, so real-world exploitation status is not established.

The direct technical outcome is a client application crash when it processes HTTP/2 interaction initiated by a malicious or compromised server. This can make an application unavailable, interrupt user workflows, or leave a client-side service unable to complete its current work. The record does not establish an impact to confidentiality or integrity, does not describe privilege escalation, and does not establish effects beyond the affected client process. Actual organisational impact depends on the application's role and its ability to recover after a crash.

The flaw can stop or crash a Qt application while it is making an HTTP/2 request, causing service disruption, failed in-flight operations, and potentially requiring the application or service to restart. The most relevant exposure is in clients that connect to external servers, partner-controlled infrastructure, or endpoints that may be compromised. Confirmed impact is loss of client-process availability; the available evidence does not show that the flaw by itself causes data disclosure, data modification, or privilege escalation.

1. Upgrade affected deployments to Qt 6.11.3 or Qt 6.12.0, using the release branch appropriate for the product.
2. Rebuild and redeploy applications linked with qtbase after the upgrade, and verify that the production runtime uses the corrected Qt build rather than only updating the build environment.
3. Review parallel Qt branches and any application-bundled Qt binaries, because the available evidence confirms the listed fixed releases but does not establish a general status for every later or parallel release.
4. If an upgrade cannot yet be completed, the reviewed evidence provides no Qt-confirmed workaround. Prioritize clients that can connect to untrusted HTTP/2 servers and treat that exposure as unresolved until a corrected release or vendor-supported mitigation is deployed.

1. Inventory applications and binaries linked with qtbase, especially components using Qt Network and QNetworkAccessManager.
2. Identify applications that use HTTP/2 client support and can connect to externally controlled, partner-controlled, or otherwise untrusted endpoints.
3. Use dependency metadata, package inventory, or build information to determine the deployed Qt branch and prioritize instances within the affected scope.
4. Review crash telemetry and unexpected application termination involving clients processing HTTP/2 responses from untrusted servers. This is a precautionary check, not a confirmed IOC, because the advisory does not define a specific log event or indicator.
5. After remediation, verify that deployed binaries use a corrected Qt build and no longer load an affected branch.