CVE-2020-13962 describes a denial-of-service vulnerability in Qt versions 5.12.2 through 5.14.2, affecting products like Mumble 1.3.0 and others utilizing QSslSocket. The flaw stems from improper handling of OpenSSL's error queue, leading to unrelated TLS sessions being disconnected when any handshake fails. With a CVSS score of 7.5 (High), this network-exploitable vulnerability has a high impact on availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.3.0CPE matchmatch criteria | cpe:2.3:a:mumble:mumble:1.3.0:-:*:*:*:*:*:* | ||
>= 5.12.2, < 5.12.9CPE matchmatch criteria | cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* | ||
>= 5.13.0, <= 5.13.2CPE matchmatch criteria | cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* | ||
>= 5.14.0, <= 5.14.2CPE matchmatch criteria | cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* | ||
31CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Qt vulnerabilities
Mar 5, 2026CVE-2020-13962
Dec 14, 2021Qt 5.12.2 through 5.14.2 as used in unofficial builds of Mumble 1.3.0 and other products mishandles OpenSSL's error queue which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected regardless of the Qt version.)
Jun 9, 2020qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications
Jun 9, 2020