{"id":"CVE-2024-39936","details":"An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..","modified":"2026-08-12T15:15:22.863321Z","published":"2024-07-04T00:00:00Z","related":["ALSA-2024:4617","ALSA-2024:4623","SUSE-SU-2024:2873-1","SUSE-SU-2024:2875-1","SUSE-SU-2024:2882-1","SUSE-SU-2024:2883-1","SUSE-SU-2024:2890-1","SUSE-SU-2024:2946-1","openSUSE-SU-2024:14114-1","openSUSE-SU-2024:14215-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"5.15.18"},{"introduced":"6.x"},{"fixed":"6.2.13"},{"introduced":"6.3.x"},{"fixed":"6.5.x"},{"fixed":"6.5.7"},{"introduced":"6.6.x"},{"fixed":"6.7.x"},{"fixed":"6.7.3"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39936.json"},"references":[{"type":"WEB","url":"https://codereview.qt-project.org/c/qt/qtbase/+/571601"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/11/msg00031.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39936.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39936"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qt/qt5","events":[{"introduced":"0"},{"fixed":"2c7b48ab7d02c13e36266954d07bc8df5789c086"},{"introduced":"78410d7e8b7aafdcbb4feea3a943038c7e0a0b5f"},{"fixed":"ddc22d5d868e82f1348523fa64f24d4df58e29b9"},{"introduced":"1734139bf4629af593e79d247a18f8e511bf7c5e"},{"fixed":"5e6055842483dedbfd604dd024b7f98e07475369"},{"introduced":"244fc454356bc9fb31a30692b8645cbfd91dc52c"},{"fixed":"90e86aee3dd3fdc502e65d5bf2916871ae9168fe"}],"database_specific":{"cpe":"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.15.18"},{"introduced":"6.0.0"},{"fixed":"6.2.13"},{"introduced":"6.3.0"},{"fixed":"6.5.7"},{"introduced":"6.6.0"},{"fixed":"6.7.3"}],"source":"CPE_RANGE"}}],"versions":["v6.5.6-lts-lgpl","v6.2.12-lts-lgpl","v5.15.16-lts-lgpl","v6.2.11-lts-lgpl","v6.5.4-lts-lgpl","v6.2.10-lts-lgpl","v5.15.15-lts-lgpl","v6.2.9-lts-lgpl","v5.15.14-lts-lgpl","v6.2.8-lts-lgpl","v5.15.13-lts-lgpl","v6.2.7-lts-lgpl","v5.15.12-lts-lgpl","v6.7.0-beta3","v6.7.0-beta2","v6.7.0-beta1","v5.15.11-lts-lgpl","v6.2.6-lts-lgpl","v5.15.10-lts-lgpl","v6.2.5-lts-lgpl","v5.15.9-lts-lgpl","v5.15.8-lts-lgpl","v6.5.0-beta3","v6.5.0-beta2","v5.15.7-lts-lgpl","v6.5.0-beta1","v5.15.6-lts-lgpl","v5.15.5-lts-lgpl","v5.15.4-lts-lgpl","v5.15.3-lts-lgpl","v6.2.0-beta4","v6.2.0-beta3","v6.2.0-beta2","v6.2.0-beta1","v6.2.0-alpha1","v6.0.0-beta5","v6.0.0-beta4","v6.0.0-beta3","v6.0.0-beta2","v6.0.0-beta1","v6.0.0-alpha1","v5.15.0-beta4","v5.15.0-beta3","v5.15.0-beta2","v5.15.0-beta1","v5.15.0-alpha1","v5.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39936.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/qt/qtbase","events":[{"introduced":"0"},{"fixed":"49adb85d34918034e0d6a4c23817407103fb9f73"},{"introduced":"fc9cda5f08ac848e88f63dd4a07c08b2fbc6bf17"},{"fixed":"8c8e225029a8c1982e04a4a5e3d62f08e84e3d15"},{"introduced":"9554d315aa74eaba1726405ee09117e2ebc6111f"},{"fixed":"fc0e66eefe3a08428ca4a6e92c66f37ac126d3c4"},{"introduced":"33f5e985e480283bb0ca9dea5f82643e825ba87c"},{"fixed":"92b685784960eea6eb353688cf0edeb94d69c6cd"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.15.18"},{"introduced":"6.0.0"},{"fixed":"6.2.13"},{"introduced":"6.3.0"},{"fixed":"6.5.7"},{"introduced":"6.6.0"},{"fixed":"6.7.3"}]}}],"versions":["v6.5.6-lts-lgpl","v6.2.12-lts-lgpl","v6.2.11-lts-lgpl","v6.5.4-lts-lgpl","v6.2.10-lts-lgpl","v5.15.16-lts-lgpl","v5.15.15-lts-lgpl","v6.2.9-lts-lgpl","v5.15.14-lts-lgpl","v6.2.8-lts-lgpl","v5.15.13-lts-lgpl","v6.7.0-beta3","v6.2.7-lts-lgpl","v6.7.0-beta2","v5.15.12-lts-lgpl","v6.7.0-beta1","v5.15.11-lts-lgpl","v6.2.6-lts-lgpl","v5.15.10-lts-lgpl","v5.15.9-lts-lgpl","v5.15.8-lts-lgpl","v6.2.5-lts-lgpl","v6.5.0-beta3","v6.5.0-beta2","v6.5.0-beta1","v5.15.7-lts-lgpl","v5.15.6-lts-lgpl","v5.15.5-lts-lgpl","v5.15.4-lts-lgpl","v5.15.3-lts-lgpl","v6.2.0-beta4","v6.2.0-beta3","v6.2.0-beta2","v6.2.0-beta1","v6.2.0-alpha1","v6.0.0-beta5","v6.0.0-beta4","v6.0.0-beta3","v6.0.0-beta2","v6.0.0-beta1","v6.0.0-alpha1","v5.15.0-beta4","v5.15.0-beta3","v5.15.0-beta2","v5.15.0-beta1","v5.15.0-alpha1","v5.0.0-beta2","v5.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39936.json","vanir_signatures_modified":"2026-08-12T15:15:22Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jdapistd.c","function":"_jpeg_skip_scanlines"},"deprecated":false,"digest":{"function_hash":"297594887767442272234953710013872217385","length":3602},"id":"CVE-2024-39936-2e029142","signature_type":"Function"},{"target":{"file":"src/3rdparty/libjpeg/src/jdapistd.c"},"deprecated":false,"digest":{"line_hashes":["238812358178134258348402339491393942744","65021909418872283462016070950310730604","281859048662224521985812577235565326302","286842166552504723994853808858585427421","105989373357661859489910015817648890689","248717183327682656008043478815848377899","262880095834214793998682684906262431669","150635852381833268752458734701239366211","70896513694721530951139813582053314188"],"threshold":0.9},"id":"CVE-2024-39936-30bb05b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd"},{"digest":{"function_hash":"171666054930286118321257300496342823173","length":1716},"id":"CVE-2024-39936-4bd5b552","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcphuff.c","function":"encode_mcu_AC_first"},"deprecated":false},{"source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jmemnobs.c"},"deprecated":false,"digest":{"line_hashes":["282271705919220662797317301953562217210","26354801347968419450462874614737305076","121448180855004584010038074524035003838","171877027560841729265860058532867137992","150037881264369561876825616417169450961","300181338973449275970315300801237141492","220502051796372030677109761646319934852","171877027560841729265860058532867137992","319836103987847772261625489613057113856"],"threshold":0.9},"id":"CVE-2024-39936-6a913096","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/3rdparty/libjpeg/src/jdmarker.c","function":"save_marker"},"deprecated":false,"digest":{"function_hash":"225691331049317106882581261176048708909","length":1873},"id":"CVE-2024-39936-7e2649bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd"},{"signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jchuff.c"},"deprecated":false,"digest":{"line_hashes":["86891332643807965807444811923206745291","170019315699302020184204478133416483597","317909979623887872167233895087085373461"],"threshold":0.9},"id":"CVE-2024-39936-7e26a850","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"120629277169633982242690646483688813814","length":2438},"id":"CVE-2024-39936-7f3ddb5f","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jdapistd.c","function":"_jpeg_crop_scanline"}},{"deprecated":false,"digest":{"function_hash":"174590571016291036914804854964422047859","length":1847},"id":"CVE-2024-39936-95c4ff74","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcphuff.c","function":"encode_mcu_AC_refine"}},{"id":"CVE-2024-39936-a7fa1a05","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jdmarker.c","function":"get_sof"},"deprecated":false,"digest":{"function_hash":"310957850098035546516130821996946822070","length":1771}},{"deprecated":false,"digest":{"function_hash":"126253469987247160605116429180815017523","length":364},"id":"CVE-2024-39936-aff347fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcomapi.c","function":"jpeg_abort"}},{"id":"CVE-2024-39936-b7328db0","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jpegint.h"},"deprecated":false,"digest":{"line_hashes":["75455869277611418914614959630974876406","243175196749763967234642741750043613100","21710536031753962687661373946722612882","98169982617924137934735667447262952962","247133728735013742670172731908185260225","5702256517840662419395978215990308436","147658319126284880460410923713024667270","328667933812664049325355441762668269728"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"116792800950565794731693741766954361280","length":1686},"id":"CVE-2024-39936-c2f925de","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcmaster.c","function":"jinit_c_master_control"}},{"target":{"file":"src/3rdparty/libjpeg/src/jcparam.c"},"deprecated":false,"digest":{"line_hashes":["155181600771589220044399818623914628812","175522640684176832842224937218734827512","11199357094457896743020596337394234841","325633496200158301648971895592423869978"],"threshold":0.9},"id":"CVE-2024-39936-c3b79787","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd"},{"target":{"file":"src/3rdparty/libjpeg/src/jchuff.c","function":"encode_one_block_simd"},"deprecated":false,"digest":{"function_hash":"242105973936000741376676343751265081177","length":250},"id":"CVE-2024-39936-cc3913da","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd"},{"id":"CVE-2024-39936-cd4e58be","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jdmarker.c"},"deprecated":false,"digest":{"line_hashes":["302884232758301730968022407404771432158","49317775225756221646264614877824123176","45589192693632696636085060402579746071","35384128077787820148826174798084727981","97988047487540332933963559917935396560","253186434447164529744763168940616558059","105122674525832142031539380152109635528","198193026461570310569226057442411103761","141222646611143444325146619650731631046","129705008597883571547080687423427338032","163067573093291491736463742390665117724","116662240200564630782194742891620402565","301429435530148583368016762475045066108","319392501251850572031089376699083262275","128517556116934408925292649810112310831","154897486283229669533782148258761294483","181296038309001628089732708770686442373","529331994227905293330925025857890284","172408687813032237706757868563829142167"],"threshold":0.9}},{"source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcmaster.c"},"deprecated":false,"digest":{"line_hashes":["333269402802645106063316925667459722265","102742791048883488537179219822252552469","14423033516855330476893821920008694249","187738562626945295431325883379031742778","61954048364348906084719228146943859077","223689068946411398329986270536965467576","108355238396913764791620047959811961483","173000129412825813869459143952277512875","194926026220282121577396968966033378919","196098982761775612093659041087098055009","64845845534642826960635715080887602682","299840145278724710675411461908022439575","86923588557925156047558937764899305064","256830621984917240702187173136627878623","263232712996669396383161278143423543938","288036106132651775767668184853843089932","126156336885997469148969269204512900849"],"threshold":0.9},"id":"CVE-2024-39936-dd034bbd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcparam.c","function":"jpeg_set_defaults"},"deprecated":false,"digest":{"function_hash":"8667423670976454694850310049638336778","length":1286},"id":"CVE-2024-39936-e446de86","signature_type":"Function"},{"id":"CVE-2024-39936-e8047157","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcomapi.c"},"deprecated":false,"digest":{"line_hashes":["205732786092169560953190835866449909816","157068406392521283438239908625514759915","95591474764287435303817237325523574084","148253672425901493956109828592924006982","33395593745310535341403424012224345905"],"threshold":0.9}},{"source":"https://github.com/qt/qtbase/commit/92b685784960eea6eb353688cf0edeb94d69c6cd","target":{"file":"src/3rdparty/libjpeg/src/jcphuff.c"},"deprecated":false,"digest":{"line_hashes":["235840524353470660703021357099231911180","96125709060957891697661255107417909062","1696369940499669501010694837610410559","118012788675233929237317989210792820590","181329525160450290875915559275620971127","218918902511246631684401247401875122747"],"threshold":0.9},"id":"CVE-2024-39936-f27572c1","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N"}]}