# CVE-2025-5455: Possible denial of service when passing malformed data in a URL to qDecodeDataUrl CVE-2025-5455 is fixed in 24 products on 1 platform, first by RHSA-2025:9486, released June 2, 2025. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2025-5455 - Priority: Routine - CVSS: 6.5 (Moderate) - EPSS: 0.0040 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 2, 2025 - Weakness: Improper Input Validation - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5455 ## Description An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libqt5-qtbase opensuse-leap 15.6 | 5.15.12+kde151-150600.3.9.1 | [SUSE-SU-2025:3723-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3723-1.md) | Oct 22, 2025 | | Linux | libqt5-qtbase sles 15.6 | 5.15.12+kde151-150600.3.9.1 | [SUSE-SU-2025:3723-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3723-1.md) | Oct 22, 2025 | | Linux | libqt5-qtbase sles 15.7 | 5.15.12+kde151-150600.3.9.1 | [SUSE-SU-2025:3723-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3723-1.md) | Oct 22, 2025 | | Linux | qt5-qtbase RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase rocky 9 | 0:5.15.9-11.el9_6 | [RLSA-2025:9462](https://patchblox.com/security/data/fix/linux/rlsa-2025-9462.md) | Oct 4, 2025 | | Linux | qt5-qtbase-common RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-common almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-common ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-devel RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-devel almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-devel ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-examples RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-examples almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-examples ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-gui RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-gui almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-gui ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-mysql RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-mysql almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-mysql ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-odbc RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-odbc almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-odbc ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-postgresql RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-postgresql almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-postgresql ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-private-devel RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-private-devel almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-private-devel ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-static RHEL 9 | 0:5.15.9-11.el9_6 | [RHSA-2025:9462](https://patchblox.com/security/data/fix/linux/rhsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-static almalinux 9 | 5.15.9-11.el9_6 | [ALSA-2025:9462](https://patchblox.com/security/data/fix/linux/alsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt5-qtbase-static ol 9 | 0:5.15.9-11.el9_6 | [ELSA-2025-9462](https://patchblox.com/security/data/fix/linux/elsa-2025-9462.md) | Jun 24, 2025 | | Linux | qt6-base Debian 13.5 (trixie) | 6.8.2+dfsg-8 | [DEBIAN-CVE-2025-5455](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5455.md) | Jun 2, 2025 | | Linux | qt6-base Debian 14 | 6.8.2+dfsg-8 | [DEBIAN-CVE-2025-5455](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5455.md) | Jun 2, 2025 | | Linux | qt6-base opensuse-leap 15.6 | 6.6.3-150600.3.6.1 | [SUSE-SU-2025:03599-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03599-1.md) | Oct 15, 2025 | | Linux | qt6-base sles 15.6 | 6.6.3-150600.3.6.1 | [SUSE-SU-2025:03599-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03599-1.md) | Oct 15, 2025 | | Linux | qt6-base sles 15.7 | 6.6.3-150600.3.6.1 | [SUSE-SU-2025:03599-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03599-1.md) | Oct 15, 2025 | | Linux | qt6-base-docs opensuse-leap 15.6 | 6.6.3-150600.3.6.1 | [SUSE-SU-2025:03599-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03599-1.md) | Oct 15, 2025 | | Linux | qt6-base-docs sles 15.6 | 6.6.3-150600.3.6.1 | [SUSE-SU-2025:03599-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03599-1.md) | Oct 15, 2025 | | Linux | qt6-base-docs sles 15.7 | 6.6.3-150600.3.6.1 | [SUSE-SU-2025:03599-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03599-1.md) | Oct 15, 2025 | | Linux | qt6-qtbase RHEL 10 | 6.8.1-9.el10_0 | [RHSA-2025:9486](https://patchblox.com/security/data/fix/linux/rhsa-2025-9486.md) | Jun 2, 2025 | | Linux | qt6-qtbase ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase rocky 10 | 0:6.8.1-9.el10_0 | [RLSA-2025:9486](https://patchblox.com/security/data/fix/linux/rlsa-2025-9486.md) | Oct 3, 2025 | | Linux | qt6-qtbase-common almalinux 10 | 6.8.1-9.el10_0 | [ALSA-2025:9486](https://patchblox.com/security/data/fix/linux/alsa-2025-9486.md) | Jun 24, 2025 | | Linux | qt6-qtbase-common ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-devel ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-examples ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-gui ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-mysql ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-odbc ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-postgresql ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-private-devel ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qt6-qtbase-static ol 10 | 0:6.8.1-9.el10_0 | [ELSA-2025-9486](https://patchblox.com/security/data/fix/linux/elsa-2025-9486.md) | Jun 30, 2025 | | Linux | qtbase-opensource-src Debian 13.5 (trixie) | 5.15.15+dfsg-6 | [DEBIAN-CVE-2025-5455](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5455.md) | Jun 2, 2025 | | Linux | qtbase-opensource-src Debian 14 | 5.15.15+dfsg-6 | [DEBIAN-CVE-2025-5455](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5455.md) | Jun 2, 2025 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.