CVE-2026-11573: CWE-674: Uncontrolled Recursion in qt

This vulnerability (CVE-2026-11573) is an uncontrolled recursion (CWE-674) in the Qt XML module's QDomDocument/QDomNode serialization path. The methods QDomElementPrivate::save() and QDomNodePrivate::save() call each other recursively without any limit on the depth of element nesting, consuming one stack frame per recursion level. When a document with deeply nested elements is serialized (via QDomDocument::toByteArray(), toString(), toCString(), QDomNode::save(), or QTextStream operator<<), the recursion can exhaust the call stack and terminate the process. The vulnerability leads to denial of service only, with no possibility of code execution or information disclosure. It affects Qt versions >=2.2.0 and <6.8.2, including 6.7.0.

An attacker can cause a denial of service by providing a document with deeply nested XML elements that triggers uncontrolled recursion during serialization, leading to process termination due to stack exhaustion. There is no impact on code execution or data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing or serializing XML documents with untrusted or deeply nested elements using the affected Qt XML serialization functions.