VULNERABILITY INTELLIGENCE
CVE-2026-96432
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-10-26
Last modified2026-10-26
Description
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.
Weakness classification
- a59d8014-47c4-4630-ab43-e1b13cbe58e3: CWE-476