CVEvulnerability

CVE-2023-32762

5.3 MEDIUM Published 2023-05-28 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2023-05-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.

Affected configurations

• debian debian linux 10.0 • qt qt (>= 5.9.0 < 5.15.14) • qt qt (>= 6.0.0 < 6.2.9) • qt qt (>= 6.3.0 < 6.5.1)

References