Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
A vulnerability in Qt's XML parsing component (QDomNode destructor) can cause unbounded recursion leading to denial-of-service (DoS) crashes when processing untrusted XML input. This affects Red Hat Hardened Images RPMs containing qt6-qtbase packages. No mitigation is currently available that meets Red Hat's criteria, and a fix has not yet been released.
AI Analysis
Technical Summary
CVE-2026-19248 is a denial-of-service vulnerability in Qt's XML parsing due to unbounded recursion in the QDomNode destructor during QDomDocument XML parsing. This flaw allows remote attackers to cause a DoS by processing crafted XML input that triggers recursive entity expansion, consuming excessive system resources. The issue affects Red Hat Hardened Images RPMs containing qt6-qtbase packages. Red Hat has published an advisory but no official fix or mitigation meeting their standards is currently available.
Potential Impact
The vulnerability can cause affected systems to become unresponsive or crash due to resource exhaustion when processing malicious XML input. This leads to a denial-of-service condition impacting availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Currently, no mitigation is available or meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for updates and apply fixes once released. Until then, avoid processing untrusted XML with affected components if possible.
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
A vulnerability in Qt's XML parsing component (QDomNode destructor) can cause unbounded recursion leading to denial-of-service (DoS) crashes when processing untrusted XML input. This affects Red Hat Hardened Images RPMs containing qt6-qtbase packages. No mitigation is currently available that meets Red Hat's criteria, and a fix has not yet been released.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19248 is a denial-of-service vulnerability in Qt's XML parsing due to unbounded recursion in the QDomNode destructor during QDomDocument XML parsing. This flaw allows remote attackers to cause a DoS by processing crafted XML input that triggers recursive entity expansion, consuming excessive system resources. The issue affects Red Hat Hardened Images RPMs containing qt6-qtbase packages. Red Hat has published an advisory but no official fix or mitigation meeting their standards is currently available.
Potential Impact
The vulnerability can cause affected systems to become unresponsive or crash due to resource exhaustion when processing malicious XML input. This leads to a denial-of-service condition impacting availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Currently, no mitigation is available or meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for updates and apply fixes once released. Until then, avoid processing untrusted XML with affected components if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:59393
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-78253"]
- State
- PUBLISHED
Threat ID: 6ab4be13f7a7c54106eee31c
Added to database: 09/24/2026, 06:07:15 UTC
Last enriched: 09/24/2026, 06:09:58 UTC
Last updated: 09/25/2026, 01:47:41 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.