CVEvulnerability

CVE-2024-39936

5.9 MEDIUM Published 2024-07-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-07-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-367

Description

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..

Affected configurations

• qt qt (< 5.15.18) • qt qt (>= 6.0.0 < 6.2.13) • qt qt (>= 6.3.0 < 6.5.7) • qt qt (>= 6.6.0 < 6.7.3)

Related

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References