{"schema":"threatline.record/2","record":{"id":"CVE-2026-105794","aliases":["GHSA-w5f4-fx9m-m4q7"],"summary":"MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL","details":"# Summary\n\nImproper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. \n\n# Details\n\nOnly MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected).\n\n## Patches\n\n2.6.1, 2.5.11, and 2.4.20\n\n# Impact\n\nAn on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.","categories":["Libraries & packages"],"product":"Microsoft.Native.Quic.MsQuic.OpenSSL","vendor":"microsoft","ecosystem":"nuget","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:33:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"Microsoft.Native.Quic.MsQuic.OpenSSL"},"range":"< 2.4.20"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:33:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"Microsoft.Native.Quic.MsQuic.OpenSSL"},"range":">= 2.5.0, < 2.5.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:33:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"Microsoft.Native.Quic.MsQuic.OpenSSL"},"range":">= 2.6.0, < 2.6.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105794","source_modified_at":"2026-10-06T17:40:05.706Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"msquic","vendor":"microsoft","versions":[{"version":"< 2.4.20","status":"affected"},{"version":">= 2.5.0, < 2.5.11","status":"affected"},{"version":">= 2.6.0, < 2.6.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:46:49.195357428Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Microsoft.Native.Quic.MsQuic.OpenSSL","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20"}]}],"versions":["1.8.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:46:49.195357428Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Microsoft.Native.Quic.MsQuic.OpenSSL","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.11"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:46:49.195357428Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Microsoft.Native.Quic.MsQuic.OpenSSL","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.1"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:33:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"Microsoft.Native.Quic.MsQuic.OpenSSL"},"version":"2.4.20"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:33:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"Microsoft.Native.Quic.MsQuic.OpenSSL"},"version":"2.5.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:33:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"Microsoft.Native.Quic.MsQuic.OpenSSL"},"version":"2.6.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:46:49.195357428Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Microsoft.Native.Quic.MsQuic.OpenSSL","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL"},"version":"2.4.20"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:46:49.195357428Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Microsoft.Native.Quic.MsQuic.OpenSSL","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL"},"version":"2.5.11"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","source_modified_at":"2026-10-06T15:46:49.195357428Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Microsoft.Native.Quic.MsQuic.OpenSSL","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL"},"version":"2.6.1"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01001,"percentile":0.6252,"score_date":"2026-10-23"},"published_at":"2026-10-06T14:14:54.483Z","modified_at":"2026-10-06T17:40:05.706Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T15:33:09Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105794","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T17:40:05.706Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T15:46:49.195357428Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105794","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105794","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/microsoft/msquic/pull/6274","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/pull/6275","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/pull/6276","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/pull/6277","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/releases/tag/v2.4.20","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/releases/tag/v2.5.11","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/microsoft/msquic/releases/tag/v2.6.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-w5f4-fx9m-m4q7","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T17:34:05.356189Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T17:40:05.706Z","content_hash":"bec796470fefec924b88362b42e147d6ed3520e9df4dadd1ab4dad9da3b30658"}}