CVE-2024-39936

What it actually does

In Qt HTTP2 handling before the listed fixed versions, security-relevant decisions on an established connection can execute prior to emission and processing of the encrypted() signal, allowing decisions based on a connection that may still be in a plaintext or pre-TLS state.

Why it matters to the business

Applications built with affected Qt versions risk exposure of sensitive data over connections that should have been treated as encrypted, potentially enabling interception or unauthorized access in client-server communications.

How an attack unfolds

An attacker intercepts or proxies an HTTP2 connection to a Qt-based application, timing the connection so that security checks evaluate the link before the TLS encrypted() signal fires, causing the application to proceed with decisions (such as authentication or data handling) on an insecure channel.

How to fix it

Upgrade qt/qtbase to the version containing commit 49adb85d34918034e0d6a4c23817407103fb9f73 or qt/qt5 to the version containing commit 5e6055842483dedbfd604dd024b7f98e07475369; rebuild and redeploy affected applications after the library update.

How to confirm the fix worked

Confirm Qt library version or source commit against the fixed revisions; test that the encrypted() signal is emitted and processed before any connection-state security decisions occur.

Typical attack path

1. Position as network intermediary to observe or manipulate traffic to the target Qt application
2. Initiate or relay an HTTP2 connection before TLS negotiation completes
3. Trigger the race window where security logic runs without the encrypted() signal having been processed
4. Abuse the resulting decision to access or influence data that should have required encryption

How to detect it

Review application logs for TLS handshake timing relative to HTTP2 connection decisions; examine network traces for plaintext HTTP2 frames preceding expected encrypted() events in Qt-based processes.

What your security team should do

• Prioritize upgrade of Qt to a fixed version in all affected products
• Inventory applications that depend on Qt HTTP2 and schedule patching
• Monitor upstream Qt release notes for any additional related fixes