CVE-2020-26164
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send...
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
CVE-2020-26164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
CVE-2020-26164- Updated
- 2026-11-02
EUVDEUVD-2020-18789 No score
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
EUVD-2020-18789- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6f3v-3c9w-7rq7
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send...
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
GHSA-6f3v-3c9w-7rq7- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-26164
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
ALPINE-CVE-2020-26164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
CVE-2020-26164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2020-26164
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
DEBIAN-CVE-2020-26164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-26164
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
- Record
UBUNTU-CVE-2020-26164- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0416 No score
Updated kdeconnect-kde packages fix a security vulnerability
An attacker on your local network could send maliciously crafted packets to other hosts running kdeconnect on the network, causing them to use large amounts of CPU, memory or network connections, which could be used in a Denial of Service attack within the network. (CVE-2020-26164)
- Record
MGASA-2020-0416- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1631-1 No score
Security update for kdeconnect-kde
This update for kdeconnect-kde fixes the following issues:
kdeconnect-kde was updated to fix various security issues in its default enabled network service (CVE-2020-26164, boo#1176268):
- Record
openSUSE-SU-2020:1631-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1647-1 No score
Security update for kdeconnect-kde
This update for kdeconnect-kde fixes the following issues:
kdeconnect-kde was updated to fix various security issues in its default enabled network service (CVE-2020-26164, boo#1176268):
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:1647-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1650-1 No score
Security update for kdeconnect-kde
This update for kdeconnect-kde fixes the following issues:
kdeconnect-kde was updated to fix various security issues in its default enabled network service (CVE-2020-26164, boo#1176268):
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2020:1650-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10890-1 No score
kdeconnect-kde-21.08.1-1.2 on GA media
These are all security issues fixed in the kdeconnect-kde-21.08.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10890-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kdeconnectAlpine:v3.13 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.14 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.15 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.16 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.17 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.18 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.19 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.20 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.21 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.22 |
before 20.08.2-r0 | 20.08.2-r0 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kdeconnectAlpine:v3.23 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectAlpine:v3.24 |
before 20.08.2-r0 | 20.08.2-r0 |
kdeconnectDebian:12 |
before 20.08.2-1 | 20.08.2-1 |
kdeconnectDebian:13 |
before 20.08.2-1 | 20.08.2-1 |
kdeconnectDebian:14 |
before 20.08.2-1 | 20.08.2-1 |
kdeconnect-kdeMageia:7 |
before 1.3.4-2.1.mga7 | 1.3.4-2.1.mga7 |
kdeconnectUbuntu:16.04:LTS |
All versions, plus listed versions 0.8-0ubuntu5 |
None known |
kdeconnectUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.3-0ubuntu21.2.1-0ubuntu11.2.1-0ubuntu21.3.0-0ubuntu11.3.1-0ubuntu0.11.3.3-0ubuntu0.18.04.1 |
None known |
kdeconnectUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.5-0ubuntu11.4-0ubuntu11.4-0ubuntu21.4-0ubuntu31.4-0ubuntu41.4-0ubuntu5 |
None known |
kdeconnectUbuntu:22.04:LTS |
All versions, plus listed versions 21.08.1-0ubuntu121.08.1-0ubuntu221.08.3-0ubuntu121.08.3-1ubuntu121.11.80-0ubuntu1 Show 6 moreShow less21.11.90-0ubuntu121.11.90-0ubuntu221.12.0-0ubuntu121.12.1-0ubuntu121.12.2-0ubuntu121.12.3-0ubuntu1 |
None known |
kdeconnectUbuntu:24.04:LTS |
All versions, plus listed versions 23.08.1-0ubuntu123.08.2-0ubuntu123.08.3-0ubuntu123.08.4-0ubuntu123.08.5-0ubuntu123.08.5-0ubuntu423.08.5-0ubuntu5 |
None known |
kdeconnectUbuntu:25.10 |
All versions, plus listed versions 24.12.3-0ubuntu225.04.0-0ubuntu125.04.0-0ubuntu225.04.1-0ubuntu125.04.2-0ubuntu2 Show 8 moreShow less25.04.2-1ubuntu125.04.3-0ubuntu125.07.80-0ubuntu125.07.90-0ubuntu125.08.0-0ubuntu125.08.1-0ubuntu125.08.1-0ubuntu225.08.1-0ubuntu2.1 |
None known |
kdeconnectUbuntu:26.10 |
All versions, plus listed versions 25.12.3-0ubuntu126.04.0-1ubuntu126.04.1-0ubuntu126.04.2-0ubuntu126.04.3-0ubuntu1 Show 5 moreShow less26.04.3-1ubuntu126.07.90-0ubuntu126.08.0-0ubuntu126.08.0-0ubuntu226.08.1-0ubuntu1 |
None known |
kdeconnectUbuntu:26.04:LTS |
All versions, plus listed versions 25.08.1-0ubuntu225.08.2-0ubuntu225.08.3-0ubuntu125.11.80-0ubuntu125.11.80-0ubuntu2 Show 7 moreShow less25.11.90-0ubuntu125.12.0-0ubuntu125.12.1-0ubuntu125.12.1-0ubuntu225.12.2-0ubuntu125.12.2-0ubuntu325.12.3-0ubuntu1 |
None known |
kdeconnect-kdeopenSUSE:Leap 15.1 |
before 20.04.2-lp152.2.3.1 | 20.04.2-lp152.2.3.1 |
kdeconnect-kdeopenSUSE:Leap 15.2 |
before 20.04.2-lp152.2.3.1 | 20.04.2-lp152.2.3.1 |
kdeconnect-kdeSUSE:Package Hub 15 SP1 |
before 1.3.3-bp151.4.3.1 | 1.3.3-bp151.4.3.1 |
kdeconnect-kdeSUSE:Package Hub 15 SP2 |
before 20.04.2-bp152.2.3.1 | 20.04.2-bp152.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26164 is a medium vulnerability (CVSS 5.5) in Kde Kdeconnect, published October 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in kdeconnect 20.08.2-r0.
References
kdeconnect.kde.org/official
github.com/KDE/kdeconnect-kde/releases
bugzilla.suse.com/show_bug.cgi?id=1176268
lists.opensuse.org/opensuse-security-announce/2020-10/msg00014.html
Show 35 moreShow less
kde.org/info/security/advisory-20201002-1.txt
openwall.com/lists/oss-security/2020/10/13/5
security.gentoo.org/glsa/202101-16
nvd.nist.gov/vuln/detail/CVE-2020-26164
security.alpinelinux.org/vuln/CVE-2020-26164
security-tracker.debian.org/tracker/CVE-2020-26164
advisories.mageia.org/MGASA-2020-0416.html
bugs.mageia.org/show_bug.cgi?id=27349
ubuntu.com/security/CVE-2020-26164
invent.kde.org/network/kdeconnect-kde/-/commit/f183b5447bad47655c21af87214579f03bf3a163
cve.org/CVERecord?id=CVE-2020-26164
suse.com/security/cve/CVE-2020-26164