cyfenced.com →

[ CVE-2026-105794 · Published 6 Oct 2026 ]

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

CVSS 9.1 EPSS 1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.1

[ Description ]Official description

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

[ Fixes ]Fixes and patches

[ Packages ]Affected open-source packages

  • Microsoft.Native.Quic.MsQuic.OpenSSL nugetAffected < 2.4.20 · fixed in 2.4.20 · GHSA-w5f4-fx9m-m4q7
  • Microsoft.Native.Quic.MsQuic.OpenSSL nugetAffected >= 2.5.0, < 2.5.11 · fixed in 2.5.11 · GHSA-w5f4-fx9m-m4q7
  • Microsoft.Native.Quic.MsQuic.OpenSSL nugetAffected >= 2.6.0, < 2.6.1 · fixed in 2.6.1 · GHSA-w5f4-fx9m-m4q7

[ References ]References