The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65897 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65897 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70560 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qt5-qtbase installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3980 advisory.

    Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction     serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into     those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default     InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12. (CVE-2026-15037)

    Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork     module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a     denial of service (application crash) via an excessively large Cache-Control header value returned by an     untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side     of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only,     with no information disclosure and no code execution. (CVE-2026-76151)

    An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When     the function is called with a QByteArray that is not NUL-terminated (for example, one created with     QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In     most cases this results in an incorrect text codec being selected; in the worst case, if the over-read     reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length     of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's     fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-     terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the     Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70561 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65816 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658160 advisory.

    [6.10.1-1.1]
    - Fix out-of-bounds read in QTextCodec::codecForName() (CVE-2026-9499)       Resolves: RHEL-247204

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65816 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1827:02 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130091 advisory.

    An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When     the function is called with a QByteArray that is not NUL-terminated (for example, one created with     QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In     most cases this results in an incorrect text codec being selected; in the worst case, if the over-read     reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length     of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's     fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-     terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the     Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789398784 advisory.

  - An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When     the function is called with a QByteArray that is not NUL-terminated (for example, one created with     QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In     most cases this results in an incorrect text codec being selected; in the worst case, if the over-read     reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length     of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's     fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-     terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the     Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. (CVE-2026-9499)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72377 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72383 advisory.

    Qt6 - Qt 5 Compatibility Libraries.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72378 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72376 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658970 advisory.

    [5.15.3-9]
    - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName()       Resolves: RHEL-247206

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65993 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
344507	AlmaLinux 8 : qt5-qtbase (ALSA-2026:65897)	Nessus	Alma Linux Local Security Checks	2026/9/10	2026/9/10	medium
344534	RockyLinux 8 : qt5-qtbase (RLSA-2026:65897)	Nessus	Rocky Linux Local Security Checks	2026/9/10	2026/9/10	medium
349533	RHEL 9 : qt5-qtbase (RHSA-2026:70560)	Nessus	Red Hat Local Security Checks	2026/9/23	2026/9/23	medium
365175	Amazon Linux 2 : qt5-qtbase (ALAS-2026-3980)	Nessus	Amazon Linux Local Security Checks	2026/10/12	2026/10/12	high
349271	RHEL 9 : qt5-qtbase (RHSA-2026:70561)	Nessus	Red Hat Local Security Checks	2026/9/23	2026/9/23	medium
344413	RockyLinux 10 : qt6-qt5compat (RLSA-2026:65816)	Nessus	Rocky Linux Local Security Checks	2026/9/9	2026/9/9	medium
344564	Oracle Linux 10 : ELSA-2026-65816-0: / qt6-qt5compat (ELSA-2026-658160)	Nessus	Oracle Linux Local Security Checks	2026/9/10	2026/9/10	medium
344579	AlmaLinux 10 : qt6-qt5compat (ALSA-2026:65816)	Nessus	Alma Linux Local Security Checks	2026/9/10	2026/9/10	medium
345713	MiracleLinux 9 : qt5-qtbase-5.15.9-11.el9_8.1 (AXSA:2026-1827:02)	Nessus	Miracle Linux Local Security Checks	2026/9/14	2026/9/14	medium
365821	Unity Linux 20.1070a Security Update: qt5-qtbase (UTSA-2026-130091)	Nessus	Unity Linux Local Security Checks	2026/10/14	2026/10/14	medium
360920	AlmaLinux 9.2 [TuxCare] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-devel / etc (ALMALINUX9.2:CLSA-2026:1789398784)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium
350890	RHEL 8 : qt5-qtbase (RHSA-2026:72377)	Nessus	Red Hat Local Security Checks	2026/9/28	2026/9/28	medium
350892	RHEL 10 : qt6-qt5compat (RHSA-2026:72383)	Nessus	Red Hat Local Security Checks	2026/9/28	2026/9/28	medium
350898	RHEL 8 : qt5-qtbase (RHSA-2026:72378)	Nessus	Red Hat Local Security Checks	2026/9/28	2026/9/28	medium
350900	RHEL 8 : qt5-qtbase (RHSA-2026:72376)	Nessus	Red Hat Local Security Checks	2026/9/28	2026/9/28	medium
344457	Oracle Linux 8 : ELSA-2026-65897-0: / qt5-qtbase (ELSA-2026-658970)	Nessus	Oracle Linux Local Security Checks	2026/9/9	2026/9/9	medium
344465	RockyLinux 9 : qt5-qtbase (RLSA-2026:65993)	Nessus	Rocky Linux Local Security Checks	2026/9/10	2026/9/10	medium

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium