CVE catalog

CVE-2024-39936

Qt vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

A vulnerability was found in Qt where, during a TLS connection for servers supporting HTTP2, Qt may send data to a server even if the TLS certificate doesn't match the redirected address. This occurs because Qt fails to validate the certificate against the redirected address, potentially sending data to an incorrect or malicious server. qtbase: qtbase: Delay any communication until encrypted() can be responded to This flaw occurs because Qt does not properly validate the certificate against the redirected address, potentially leading to sensitive data being sent to an unintended or malicious server. Given the potential for significant data exposure, this issue is considered important. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianqt6-basesid6.11.2+dfsg-7fixed
Debianqt6-baseforky6.11.2+dfsg-5fixed
Debianqt6-basetrixie6.8.2+dfsg-9+deb13u2fixed
Debianqt6-basebookworm6.4.2+dfsg-10vulnerable
Debianqtbase-opensource-srcsid5.15.19+dfsg-6fixed
Debianqtbase-opensource-srcforky5.15.19+dfsg-5fixed
Debianqtbase-opensource-srctrixie5.15.15+dfsg-6+deb13u1fixed
Debianqtbase-opensource-srcbookworm5.15.8+dfsg-11+deb12u3fixed
Debianqtbase-opensource-src-glessid5.15.19+dfsg-2vulnerable
Debianqtbase-opensource-src-glesforky5.15.19+dfsg-2vulnerable
Debianqtbase-opensource-src-glestrixie5.15.15+dfsg-2vulnerable
Debianqtbase-opensource-src-glesbookworm5.15.8+dfsg-3vulnerable
Ubuntuqt6-basenobleNot reportedvulnerable
Ubuntuqtbase-opensource-src-glesnobleNot reportedvulnerable
Ubuntuqtbase-opensource-srcnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5concurrent5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5core5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5dbus5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5gui5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5network5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5opengl5-devnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5opengl5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5printsupport5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5-ibasenoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5-mysqlnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5-odbcnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5-psqlnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5-sqlitenoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5-tdsnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5sql5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5test5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5widgets5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntulibqt5xml5t64noble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqt5-gtk-platformthemenoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqt5-qmakenoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqt5-qmake-binnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqt5-xdgdesktopportal-platformthemenoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-devnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-dev-toolsnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-docnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-doc-devnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-doc-htmlnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-examplesnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase5-private-devnoble5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase-opensource-srcpro5.15.10+dfsg-3vulnerable
Ubuntuqtbase-opensource-srcpro5.15.10+dfsg-5vulnerable
Ubuntuqtbase-opensource-srcpro5.15.10+dfsg-5ubuntu1vulnerable
Ubuntuqtbase-opensource-srcpro5.15.12+dfsg-1ubuntu1vulnerable
Ubuntuqtbase-opensource-srcpro5.15.12+dfsg-3ubuntu1vulnerable
Ubuntuqtbase-opensource-srcpro5.15.12+dfsg-3ubuntu6vulnerable
Ubuntuqtbase-opensource-srcpro5.15.12+dfsg-3ubuntu7vulnerable
Ubuntuqtbase-opensource-srcpro5.15.13+dfsg-1ubuntu1vulnerable
Ubuntuqtbase-opensource-srcpro5.15.13+dfsg-1ubuntu1+esm1fixed
Ubuntuqtbase-opensource-src22.045.15.2+dfsg-12vulnerable
Ubuntuqtbase-opensource-src22.045.15.2+dfsg-13vulnerable
Ubuntuqtbase-opensource-src22.045.15.2+dfsg-14vulnerable
Ubuntuqtbase-opensource-src22.045.15.2+dfsg-14ubuntu1vulnerable
Ubuntuqtbase-opensource-src22.045.15.2+dfsg-14ubuntu3vulnerable
Ubuntuqtbase-opensource-src22.045.15.2+dfsg-15vulnerable
Ubuntuqtbase-opensource-src22.045.15.3+dfsg-1vulnerable
Ubuntuqtbase-opensource-src22.045.15.3+dfsg-2vulnerable
Ubuntuqtbase-opensource-src22.045.15.3+dfsg-2ubuntu0.1vulnerable
Ubuntuqtbase-opensource-src22.045.15.3+dfsg-2ubuntu0.2vulnerable
Ubuntuqtbase-opensource-src24.045.15.10+dfsg-3vulnerable
Ubuntuqtbase-opensource-src24.045.15.10+dfsg-5vulnerable
Ubuntuqtbase-opensource-src24.045.15.10+dfsg-5ubuntu1vulnerable
Ubuntuqtbase-opensource-src24.045.15.12+dfsg-1ubuntu1vulnerable
Ubuntuqtbase-opensource-src24.045.15.12+dfsg-3ubuntu1vulnerable
Ubuntuqtbase-opensource-src24.045.15.12+dfsg-3ubuntu6vulnerable
Ubuntuqtbase-opensource-src24.045.15.12+dfsg-3ubuntu7vulnerable
Ubuntuqtbase-opensource-src24.045.15.13+dfsg-1ubuntu1vulnerable
Suseqt6-baselinux enterprise module for desktop applications 15 sp66.6.3-150600.3.3.1fixed
Suseqt6-baselinux enterprise module for package hub 15 sp66.6.3-150600.3.3.1fixed
Suseqt6-base-docslinux enterprise module for package hub 15 sp66.6.3-150600.3.3.1fixed
Opensuseqt6-baseleap 15.66.6.3-150600.3.3.1fixed
Opensuseqt6-base-docsleap 15.66.6.3-150600.3.3.1fixed
Opensuseqt6-basetumbleweed6.7.2-2.1fixed
Opensuselibqt5-qtbasetumbleweed5.15.14+kde143-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianqt6-basesourcesid6.8.2+dfsg-5not yet assignedNot reported[1076292]
Debianqt6-basesourceforky6.8.2+dfsg-5not yet assignedNot reported[1076292]
Debianqt6-basesourcetrixie6.8.2+dfsg-5not yet assignedNot reported[1076292]
Debianqt6-basesourcebookworm(unfixed)not yet assignedNot reported[1076292]
Debianqtbase-opensource-srcsourcesid5.15.13+dfsg-3not yet assignedNot reported[1076293]
Debianqtbase-opensource-srcsourceforky5.15.13+dfsg-3not yet assignedNot reported[1076293]
Debianqtbase-opensource-srcsourcetrixie5.15.13+dfsg-3not yet assignedNot reported[1076293]
Debianqtbase-opensource-srcsourcebookworm5.15.8+dfsg-11+deb12u3not yet assignedNot reported[1076293]
Debianqtbase-opensource-src-glessourcesid(unfixed)unimportantNot reported[1077544]
Debianqtbase-opensource-src-glessourceforky(unfixed)unimportantNot reported[1077544]
Debianqtbase-opensource-src-glessourcetrixie(unfixed)unimportantNot reported[1077544]
Debianqtbase-opensource-src-glessourcebookworm(unfixed)unimportantNot reported[1077544]
Ubuntuqtbase-opensource-srcdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5concurrent5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5core5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5dbus5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5gui5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5network5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5opengl5-devdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5opengl5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5printsupport5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5-ibasedebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5-mysqldebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5-odbcdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5-psqldebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5-sqlitedebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5-tdsdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5sql5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5test5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5widgets5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5xml5t64debnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqt5-gtk-platformthemedebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqt5-qmakedebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqt5-qmake-bindebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqt5-xdgdesktopportal-platformthemedebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-devdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-dev-toolsdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-docdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-doc-devdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-doc-htmldebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-examplesdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase5-private-devdebnoble5.15.13+dfsg-1ubuntu1+esm1Not reportedNot reportedNot reported
Ubuntuqtbase-opensource-srcdebpro5.15.13+dfsg-1ubuntu1+esm1Not reportedUBUNTU-CVE-2024-39936Not reported
Suseqt6-baserpmlinux enterprise module for desktop applications 15 sp66.6.3-150600.3.3.1Not reportedSUSE-SU-2024:2875-1Not reported
Suseqt6-baserpmlinux enterprise module for package hub 15 sp66.6.3-150600.3.3.1Not reportedSUSE-SU-2024:2875-1Not reported
Suseqt6-base-docsrpmlinux enterprise module for package hub 15 sp66.6.3-150600.3.3.1Not reportedSUSE-SU-2024:2875-1Not reported
Opensuseqt6-baserpmleap 15.66.6.3-150600.3.3.1Not reportedSUSE-SU-2024:2875-1Not reported
Opensuseqt6-base-docsrpmleap 15.66.6.3-150600.3.3.1Not reportedSUSE-SU-2024:2875-1Not reported
Opensuseqt6-baserpmtumbleweed6.7.2-2.1Not reportedOPENSUSE-SU-2024:14114-1Not reported
Opensuselibqt5-qtbaserpmtumbleweed5.15.14+kde143-1.1Not reportedOPENSUSE-SU-2024:14215-1Not reported

[Debian bug #1076292][Debian bug #1076293][Debian bug #1077544]

Notes

[bookworm] qt6-base: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libqt5gui5-gles]Affected

    Source package: [qtbase-opensource-src-gles]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtbase-opensource-src-gles · debian · bookworm; usn · qtbase-opensource-src-gles · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtbase-opensource-src-gles · debian · bookworm; usn · qtbase-opensource-src-gles · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6core6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6dbus6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6gui6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6network6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6opengl6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6sql6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6sql6-odbc]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6sql6-psql]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6test6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6widgets6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [libqt6xml6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

  • [qmake6]Affected

    Source package: [qt6-base]

    Details (2)
    • 6.4.2+dfsg-10 · amd64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

    • 6.4.2+dfsg-10 · arm64 · bookworm

      Affected

      usn · qt6-base · debian · bookworm; usn · qt6-base · debian · 12

Next results

Observed:

References