Resource exhaustion in KDE Connect - CVE-2020-26164
Published: October 2, 2020
Vulnerability identifier: #VU47271
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-26164
CWE-ID: CWE-400
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing network packets. A remote attacker on a local network can send specially crafted packets to other hosts running kdeconnect and cause the application to consume large amounts of CPU and memory.
Affected software
KDE Connect
Arch Linux
Gentoo Linux
SUSE Linux
Opensuse
kdeconnect (Alpine package)
Arch Linux
Gentoo Linux
SUSE Linux
Opensuse
kdeconnect (Alpine package)
How to mitigate CVE-2020-26164
Install updates from vendor's website.
KDE Connect - update to 20.08.1
kdeconnect (Alpine package) - update to 20.08.2-r0
kdeconnect (Alpine package) - update to 20.08.2-r0