Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

The version of qt5-qtbase installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3980 advisory.

    Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction     serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into     those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default     InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12. (CVE-2026-15037)

    Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork     module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a     denial of service (application crash) via an excessively large Cache-Control header value returned by an     untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side     of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only,     with no information disclosure and no code execution. (CVE-2026-76151)

    An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When     the function is called with a QByteArray that is not NUL-terminated (for example, one created with     QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In     most cases this results in an incorrect text codec being selected; in the worst case, if the over-read     reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length     of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's     fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-     terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the     Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction
    serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into
    those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default
    InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12. (CVE-2026-15037)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction     serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into     those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default     InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12. (CVE-2026-15037)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365175	Amazon Linux 2 : qt5-qtbase (ALAS-2026-3980)	Nessus	Amazon Linux Local Security Checks	Local	high
458702	Echo: qtbase-opensource-src: security update to 5.15.15+dfsg-6+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458702	Echo: qtbase-opensource-src: security update to 5.15.15+dfsg-6+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
329733	Linux Distros Unpatched Vulnerability : CVE-2026-15037	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-15037

medium

Tenable Plugins

high

medium

medium

medium