CVE-2023-51714

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-24 · updated 2026-10-08
Weakness: CWE-190

Description

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.

Affected products

Debian Linux: 10.0
Qt: from 5.7 before 5.15.17; from 6.0.0 before 6.2.11; from 6.3.0 before 6.5.4; from 6.6.0 before 6.6.2 — fixed in 5.15.17, 6.2.11, 6.5.4, 6.6.2

How to fix

Upgrade to a fixed version: Qt 5.15.17, 6.2.11, 6.5.4, 6.6.2. Check the vendor advisory for mitigations.

References

https://codereview.qt-project.org/c/qt/qtbase/+/524864
https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
https://codereview.qt-project.org/c/qt/qtbase/+/524864
https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html

Get alerted when CVE-2023-51714 or the next vulnerability affects your stack