~ / search / GHSA-w5f4-fx9m-m4q7

GHSA-w5f4-fx9m-m4q7

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-105794

Packages

EcosystemPackageAffectedFixed in
NuGet Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.20 2.4.20
NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0, < 2.5.11 2.5.11
NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.6.0, < 2.6.1 2.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

# Summary Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. # Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected). ## Patches 2.6.1, 2.5.11, and 2.4.20 # Impact An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.

References

External links from the advisory. They lead to third-party sites.