CVE-2024-39936

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://codereview.qt-project.org/c/qt/qtbase/+/571601Vendor Advisory
https://codereview.qt-project.org/c/qt/qtbase/+/571601Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/11/msg00031.html

Timeline

Published: Jul 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-399377.5supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.CVE-2024-39945.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tut CVE-2024-399438.8rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if CVE-2024-399447.5A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, ca CVE-2024-399454.9A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefu CVE-2024-399467.2A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefull CVE-2024-399476.5A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefull CVE-2024-399487.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, c CVE-2024-399497.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, c CVE-2024-39952.0In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.CVE-2024-399509.8A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to CVE-2024-399546.3CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker