{"id":"CVE-2026-96432","published":"2026-10-26T12:17:08.420","lastModified":"2026-10-26T18:39:42.503","description":"A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/759718","tags":[]},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-96432:","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}