CVE-2025-5991 - CVE House
Back to Database
Status published Low CVE-2025-5991

Use after free in QHttp2ProtocolHandler

Vulnerability Description

There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not affected by this at all. This happens due to a race condition between how QHttp2Stream uploads the body of a POST request and the simultaneous handling of HTTP error responses. This issue only affects Qt 6.9.0 and has been fixed for Qt 6.9.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5991

Credits & Attribution

No credits recorded in the NVD database.

References

More from The Qt Company

View All →
CVE-2025-6338
Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend
Critical 9.2
CVE-2025-5992
Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service
Low 2.3
CVE-2025-5683
When loading a specifically crafted ICNS format image file in...
Medium 5.1
CVE-2025-5455
Possible denial of service when passing malformed data in a URL to qDecodeDataUrl
High 8.4
CVE-2025-4211
Improper Link Resolution Before File Access in QFileSystemEngine on Windows
High 7.3

Affected Vendor

The Qt Company

View all reports →

Affected Software

Qt
Vulnerable Versions:
0, 6.9.0, 6.9.1

Timeline

Official Publish: June 11th, 2025
Last Modified: June 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-416

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact