CVE-2010-5076: QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an...

Security readout for executives and security teams

This issue affects older Qt SSL client code. A malicious party in a man-in-the-middle position could use a legitimately issued but crafted certificate to make a Qt-based client trust the wrong SSL server. Business impact depends on whether legacy Qt-based applications still handle sensitive network connections. Exposure is most likely in legacy applications built with Qt versions before 4.7.0-rc1, including systems relying on distribution Qt packages from the period covered by Ubuntu and Red Hat advisories. The source bundle does not identify specific applications or current affected products. Treat this as an inventory-driven legacy risk. It is not KEV-listed in the provided bundle, but any affected Qt client protecting sensitive traffic should be patched or retired because the flaw undermines TLS server identity checks. Mitigation focus: Inventory applications and packages using Qt QSslSocket.; Upgrade Qt to 4.7.0-rc1 or later, or vendor-fixed packages.; Prioritize statically linked Qt applications for rebuild review..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.