# CVE-2026-11573: Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

CVE-2026-11573 is fixed in 12 products on 1 platform, first by RHSA-2026:84582, released September 8, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-11573
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0039
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 8, 2026
- Weakness: Uncontrolled Recursion
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11573

## Description

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | qt5-qtbase RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase rocky 8 | 0:5.15.3-10.el8_10 | [RLSA-2026:93924](https://patchblox.com/security/data/fix/linux/rlsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase rocky 9 | 0:5.15.9-11.el9_8.2 | [RLSA-2026:87082](https://patchblox.com/security/data/fix/linux/rlsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-common RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-common RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-common almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-common almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-common ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-common ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-devel RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-devel RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-devel almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-devel almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-devel ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-devel ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-examples RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-examples RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-examples almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-examples almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-examples ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-examples ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-gui RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-gui RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-gui almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-gui almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-gui ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-gui ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-mysql RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-mysql RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-mysql almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-mysql almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-mysql ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-mysql ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-odbc RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-odbc RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-odbc almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-odbc almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-odbc ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-odbc ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-postgresql RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-postgresql RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-postgresql almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-postgresql almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-postgresql ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-postgresql ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-private-devel RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-private-devel RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-private-devel almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-private-devel almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-private-devel ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-private-devel ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-static RHEL 8 | 0:5.15.3-10.el8_10 | [RHSA-2026:93924](https://patchblox.com/security/data/fix/linux/rhsa-2026-93924.md) | Nov 3, 2026 |
| Linux | qt5-qtbase-static RHEL 9 | 0:5.15.9-11.el9_8.2 | [RHSA-2026:87082](https://patchblox.com/security/data/fix/linux/rhsa-2026-87082.md) | Oct 24, 2026 |
| Linux | qt5-qtbase-static almalinux 8 | 5.15.3-10.el8_10 | [ALSA-2026:93924](https://patchblox.com/security/data/fix/linux/alsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-static almalinux 9 | 5.15.9-11.el9_8.2 | [ALSA-2026:87082](https://patchblox.com/security/data/fix/linux/alsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-static ol 8 | 0:5.15.3-10.el8_10 | [ELSA-2026-93924](https://patchblox.com/security/data/fix/linux/elsa-2026-93924.md) | Nov 7, 2026 |
| Linux | qt5-qtbase-static ol 9 | 0:5.15.9-11.el9_8.2 | [ELSA-2026-87082](https://patchblox.com/security/data/fix/linux/elsa-2026-87082.md) | Nov 7, 2026 |
| Linux | qt6-base Debian 13.5 (trixie) | 6.8.2+dfsg-5 | [DEBIAN-CVE-2026-11573](https://patchblox.com/security/data/fix/linux/debian-cve-2026-11573.md) | Sep 14, 2026 |
| Linux | qt6-base Debian 14 | 6.8.2+dfsg-5 | [DEBIAN-CVE-2026-11573](https://patchblox.com/security/data/fix/linux/debian-cve-2026-11573.md) | Sep 14, 2026 |
| Linux | qt6-qtbase RHEL 10 | 6.8.1-9.el10_0.1 | [RHSA-2026:84582](https://patchblox.com/security/data/fix/linux/rhsa-2026-84582.md) | Sep 8, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.