Threats affecting pkg:maven/org.qtproject/qtcoap

CVE-2026-103653 is an out-of-bounds read vulnerability in the Qt CoAP module's message parsing function QCoapInternalReply::createFromFrame(). Processing a malformed CoAP message can cause applications using Qt CoAP to crash or operate on incorrect data, potentially affecting availability and integrity. The vulnerability affects Qt versions from 5.13.0 through 6.8.8 and 6.9.0 through 6.11.2. The CVSS 4.0 base score is 6.7, indicating medium severity.