PatchTheCVECVE-2018-21035: In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages
CVE-2018-21035 is a high-severity flaw (CVSS 7.5) affecting qt. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.3% (top 16%) |
| CISA exploited list | No |
| Weakness | CWE-770 |
| Published | 2020-02-28 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-21035?
qt: upgrade to newer than 5.14.1. Exact commands for each OS are on this page.
Is CVE-2018-21035 being exploited?
CVE-2018-21035 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-21035 affect?
CVE-2018-21035 affects qt. Severity is high (CVSS 7.5). In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).
How urgent is CVE-2018-21035?
Priority 57/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-51714 CRITICAL 9.8 MITIGATE UPGRADE An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5
- CVE-2020-0570 HIGH 7.3 UPGRADE MITIGATE Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to
- CVE-2025-5683 MEDIUM 5.5 UPGRADE When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issu
- CVE-2024-39936 HIGH 8.6 UPGRADE An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, an
- CVE-2024-36048 CRITICAL 9.8 UPGRADE MITIGATE QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before