Qt6-qtbase contains a denial-of-service vulnerability in its QDomDocument XML parsing component and an out-of-bounds read vulnerability in HTTP Cache-Control header parsing within the QtNetwork module. The Cache-Control header parsing flaw affects Qt versions from 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1 on 64-bit builds, allowing remote attackers to cause application crashes via a crafted HTTP response header. The vulnerability is fixed in version 6.5.2-18.oe2403sp4.