CVE-2024-39936: qt

CVSS: 8.6v3.1HighModified

AliasesRHSA-2024:4617RHSA-2024:4621RHSA-2024:4623+11 more

Published 04-07-2024Last modified 29-11-2025

Vulnerability summary

CVE-2024-39936 is a high (CVSS 8.6) vulnerability in qt. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.8% of scored vulnerabilities.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.6/10

010

High · v3.1 (CVE.org)

EPSS score

0.49%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 7

MGASA-2025-0046 SUSE-SU-2024:2873-1 SUSE-SU-2024:2875-1 SUSE-SU-2024:2882-1 SUSE-SU-2024:2883-1 SUSE-SU-2024:2890-1+2 more

Timeline

04-07-2024
PublishedVulnerability first disclosed.
29-11-2025
Last modifiedVulnerability information updated.

Description

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..

CVSS metrics

5 scores · 5 sources · 1 version

v3.18.6

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

0.00 pp

From 0.49% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Affected systems

Redhat21 products

qt5-qtbase< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-common< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-debugsource< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-devel< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9

qt5-qtbase-devel-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-doc< 0:5.9.7-6.el7_9
qt5-qtbase-examples< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-examples-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-gui< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-gui-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-mysql< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-mysql-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-odbc< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-odbc-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-postgresql< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2 | < 0:5.9.7-6.el7_9
qt5-qtbase-postgresql-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-private-devel< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-qtbase-static< 0:5.15.3-8.el8_10 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.9.7-6.el7_9
qt5-qtbase-tests-debuginfo< 0:5.15.3-8.el8_10 | < 0:5.12.5-9.el8_4 | < 0:5.15.9-10.el9_4 | < 0:5.15.3-2.el9_2 | < 0:5.15.3-2.el8_8 | < 0:5.15.2-5.el8_6 | < 0:5.15.2-30.el9_0 | < 0:5.12.5-5.el8_2
qt5-rpm-macros< 0:5.9.7-6.el7_9

Show all 21

Debian3 products

qt6-baseAll versions (No fix recorded) | < 6.8.2+dfsg-5
qtbase-opensource-src< 5.15.8+dfsg-11+deb12u3 | < 5.15.13+dfsg-3 | < 5.15.2+dfsg-9+deb11u2
qtbase-opensource-src-glesAll versions (No fix recorded)

Opensuse2 products

libqt5-qtbase&distro=openSUSE Tumbleweed< 5.15.14+kde143-1.1
qt6-base&distro=openSUSE Tumbleweed< 6.7.2-2.1

Qt1 product

qt< 5.15.18 | ≥ 6.0.0, < 6.2.13 | ≥ 6.3.0, < 6.5.7 | ≥ 6.6.0, < 6.7.3

Ubuntu1 product

qtbase-opensource-src< 5.12.8+dfsg-0ubuntu2.1+esm3 | All versions (No fix recorded) | < 5.15.3+dfsg-2ubuntu0.2+esm3 | < 5.15.13+dfsg-1ubuntu1+esm1

5 vendors · 28 products

References

31 links

codereview.qt-project.org/c/qt/qtbase/+/571601ARTICLEREPORTVendor Advisory
lists.debian.org/debian-lts-announce/2025/11/msg00031.html
access.redhat.com/errata/RHSA-2024:4617Advisory
access.redhat.com/security/updates/classification/ARTICLE
docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.10_release_notes/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2295867REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4617.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-39936REPORT
www.cve.org/CVERecord?id=CVE-2024-39936AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-39936AdvisoryOval

Show all 31 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities