An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_98535 advisory.

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.3 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_98636 advisory.

    * qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header     (CVE-2026-76151)

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:98636 advisory.

    * qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header     (CVE-2026-76151)

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_98103 advisory.

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:98535 advisory.

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:98103 advisory.

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-98103 advisory.

    [5.15.3-11]
    - CVE-2026-16762 qt5: qt: Denial of Service via crafted XML parsing in QXmlStreamReader       Resolves: RHEL-291031

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:99149 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:98103 advisory.

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99155 advisory.

    Qt is a software toolkit for developing applications.  This package contains base tools, like string, xml,     and network handling.

    Security Fix(es):

    * qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header     (CVE-2026-76151)

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98636 advisory.

    Qt is a software toolkit for developing applications.  This package contains base tools, like string, xml,     and network handling.

    Security Fix(es):

    * qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header     (CVE-2026-76151)

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:98535 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:98103 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qt5-qtbase installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4060 advisory.

    An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause     disproportionate CPU consumption during parsing, making the application unresponsive (denial of service).
    Exploitation requires only that the application parse attacker-influenced XML; no authentication,     privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality     or integrity -- no data disclosure, data modification, or code execution -- and the impact is contained to     the affected process. (CVE-2026-16762)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause
    disproportionate CPU consumption during parsing, making the application unresponsive (denial of service).
    Exploitation requires only that the application parse attacker-influenced XML; no authentication,
    privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality
    or integrity — no data disclosure, data modification, or code execution — and the impact is contained to
    the affected process. (CVE-2026-16762)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause     disproportionate CPU consumption during parsing, making the application unresponsive (denial of service).
    Exploitation requires only that the application parse attacker-influenced XML; no authentication,     privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality     or integrity  no data disclosure, data modification, or code execution  and the impact is contained to     the affected process. (CVE-2026-16762)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
381185	Rocky Linux 9 [CIQ] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-debuginfo / etc (crlsa-2026_98535)	Nessus	Rocky Linux Local Security Checks	Local	high
381078	Rocky Linux 10.3 [CIQ] Security Update: qt6-qtbase / qt6-qtbase-common / qt6-qtbase-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_98636)	Nessus	Rocky Linux Local Security Checks	Local	high
380344	RockyLinux 10 : qt6-qtbase (RLSA-2026:98636)	Nessus	Rocky Linux Local Security Checks	Local	high
380274	Rocky Linux 8 [CIQ] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-debuginfo / etc (crlsa-2026_98103)	Nessus	Rocky Linux Local Security Checks	Local	high
380246	RockyLinux 9 : qt5-qtbase (RLSA-2026:98535)	Nessus	Rocky Linux Local Security Checks	Local	high
380203	AlmaLinux 8 : qt5-qtbase (ALSA-2026:98103)	Nessus	Alma Linux Local Security Checks	Local	high
379839	Oracle Linux 8 : qt5-qtbase (ELSA-2026-98103)	Nessus	Oracle Linux Local Security Checks	Local	high
379615	RHEL 9 : qt5-qtbase (RHSA-2026:99149)	Nessus	Red Hat Local Security Checks	Local	high
379581	RockyLinux 8 : qt5-qtbase (RLSA-2026:98103)	Nessus	Rocky Linux Local Security Checks	Local	high
379356	RHEL 10 : qt6-qtbase (RHSA-2026:99155)	Nessus	Red Hat Local Security Checks	Local	high
379017	RHEL 10 : qt6-qtbase (RHSA-2026:98636)	Nessus	Red Hat Local Security Checks	Local	high
378865	RHEL 9 : qt5-qtbase (RHSA-2026:98535)	Nessus	Red Hat Local Security Checks	Local	high
378718	RHEL 8 : qt5-qtbase (RHSA-2026:98103)	Nessus	Red Hat Local Security Checks	Local	high
374326	Amazon Linux 2 : qt5-qtbase (ALAS-2026-4060)	Nessus	Amazon Linux Local Security Checks	Local	high
477489	Echo: qtbase-opensource-src: security update to 5.15.15+dfsg-6+e7	Tenable Cloud Security	Echo Local Security Checks	Local	high
477489	Echo: qtbase-opensource-src: security update to 5.15.15+dfsg-6+e7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
371712	Linux Distros Unpatched Vulnerability : CVE-2026-16762	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-16762

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high