Early Execution of Security-Relevant Decisions in HTTP2 Could Lead to Security Risks
CVE-2024-39936

8.6HIGH

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
4 July 2024

What is CVE-2024-39936?

A vulnerability exists in the HTTP2 implementation of Qt, where security-relevant decisions regarding established connections may be prematurely executed. This issue arises because the critical 'encrypted()' signal has not yet been emitted and processed, potentially exposing a window for malicious activity. Developers using the affected versions of Qt should prioritize upgrading to secure the integrity of their connections.

References

https://codereview.qt-project.org/c/qt/qtbase/+/571601

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.