In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network…
Priority LOW 26CWE-400Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Why it matters now
EPSS 0.00551 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kde:kdeconnect:*:*:*:*:*:*:*:* | before 20.08.2 | Vulnerable | KDE |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* | 15.0 sp1 | Vulnerable | openSUSE |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* | 15.0 sp2 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
- cpe:2.3:a:kde:kdeconnect:*:*:*:*:*:*:*:* Versions before 20.08.2 Vulnerable ·KDE
- cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
- cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* Versions 15.0 sp2 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26164
- 2026-10-03 Alias added: GHSA-6f3v-3c9w-7rq7
References
Patch 6
- https://github.com/KDE/kdeconnect-kde/commit/ce0f00fc2d3eccb51d0af4eba61a4f60de086a59
- https://github.com/KDE/kdeconnect-kde/commit/542d94a70c56aa386c8d4d793481ce181b0422e8
- https://github.com/KDE/kdeconnect-kde/commit/613899be24b6e2a6b3e5cc719efce8ae8a122991
- https://github.com/KDE/kdeconnect-kde/commit/024e5f23db8d8ad3449714b906b46094baaffb89
- https://github.com/KDE/kdeconnect-kde/commit/4fbd01a3d44a0bcca888c49a77ec7cfd10e113d7
- https://github.com/KDE/kdeconnect-kde/commit/8112729eb0f13e6947984416118531078e65580d
Advisory 10
- https://github.com/KDE/kdeconnect-kde/releases
- https://bugzilla.suse.com/show_bug.cgi?id=1176268
- https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00014.html
- https://kde.org/info/security/advisory-20201002-1.txt
- openSUSE-SU-2020:1647
- openSUSE-SU-2020:1650
- [oss-security] 20201013 Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon
- [oss-security] 20201013 kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon
- [oss-security] 20201014 Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon
- GLSA-202101-16
Sources
- CVE-2020-26164 · CVE Program
- CVE-2020-26164 · NVD
- FIRST EPSS
- GHSA-6f3v-3c9w-7rq7 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26164 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences