Null Pointer Dereference in Qt Network Module from Compromised HTTP/2 Server

CVE-2026-96432

What is CVE-2026-96432?

A vulnerability exists in the Qt Network module where a malicious or compromised HTTP/2 server can exploit the handling of SETTINGS ACK. This can result in the injection of a null pointer through an RST_STREAM command on a finalized stream. The server could then issue a PUSH_PROMISE for that same stream, leading to a null pointer dereference within the QNetworkAccessManager class, which subsequently crashes the application, jeopardizing system stability and security.

References