microsoft/msquic · Security
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
- GHSA ID
- GHSA-w5f4-fx9m-m4q7
- CVE ID
- CVE-2026-105794
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Summary
Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic.
Details
Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected).
Patches
2.6.1, 2.5.11, and 2.4.20
Impact
An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.
CWEs
- CWE-295 · Improper Certificate Validation
References
- https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-105794 ↗
- https://github.com/microsoft/msquic/pull/6274 ↗
- https://github.com/microsoft/msquic/pull/6275 ↗
- https://github.com/microsoft/msquic/pull/6276 ↗
- https://github.com/microsoft/msquic/pull/6277 ↗
- https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412 ↗
- https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91 ↗
- https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81 ↗
- https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83 ↗
- https://github.com/microsoft/msquic/releases/tag/v2.4.20 ↗
- https://github.com/microsoft/msquic/releases/tag/v2.5.11 ↗
- https://github.com/microsoft/msquic/releases/tag/v2.6.1 ↗
- https://github.com/advisories/GHSA-w5f4-fx9m-m4q7 ↗