Debian Patches
Status for qt6-httpserver/6.11.2-3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| upstream_CVE-2026-110944_4b91991.diff | Cap chunk-size line length to prevent memory exhaustion getChunkSize() appended the chunk-size line into the shared fragment buffer byte by byte with no ceiling, and the body-size limit never applies (it gates decoded body bytes only). A chunked request with an endless hex string or unterminated chunk-extension thus grew fragment until OOM. Bound it per byte via isHeaderFieldSizeAllowed() (48 KiB), sending 400 and returning -1. Manually created cherry-pick for 6.11.3 (cherry picked from commit 988f1d72679f4fe55442af4f431d1c5b11171656) (cherry picked from commit d0b683915dd1d29a161366e074aae50ba932c24f) |
Mate Barany <mate.barany@qt.io> | no | 2026-09-08 | ||
| upstream_CVE-2026-110944_eda23f6.diff | Validate chunk size and reject malformed or out-of-range values getChunkSize() parsed the chunk-size line with toLong(&ok, 16) and ignored ok. Parse with toULongLong() at qsizetype width, check ok, and reject a value that does not fit qsizetype with 400 Bad Request. Manually created cherry-pick for 6.11.3 (cherry picked from commit 283ee840051532421dcc5788b4233b23eaec1752) (cherry picked from commit 3376ff1f1fde969f8249248b99aedcc47a095ab0) |
Mate Barany <mate.barany@qt.io> | no | 2026-09-09 |