All vulnerabilities
CVE-2026-105794GHSA-w5f4-fx9m-m4q7

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

microsoft Microsoft.Native.Quic.MsQuic.OpenSSLnugetLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.00%Chance of exploitation activity in the next 30 days, higher than 62% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.4.20Also 2.5.11, 2.6.1GitHub
Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

  • 2.4.20Microsoft.Native.Quic.MsQuic.OpenSSL, nugetGitHubdotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.4.20
  • 2.5.11Microsoft.Native.Quic.MsQuic.OpenSSL, nugetGitHubdotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.5.11
  • 2.6.1Microsoft.Native.Quic.MsQuic.OpenSSL, nugetGitHubdotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.6.1
  • 2.4.20Microsoft.Native.Quic.MsQuic.OpenSSL, NuGetOSVdotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.4.20
  • 2.5.11Microsoft.Native.Quic.MsQuic.OpenSSL, NuGetOSVdotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.5.11
  • 2.6.1Microsoft.Native.Quic.MsQuic.OpenSSL, NuGetOSVdotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.6.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic.

Details

Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected).

Patches

2.6.1, 2.5.11, and 2.4.20

Impact

An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.

Text from GitHub Advisory Database

Affected versions 10

  • Microsoft.Native.Quic.MsQuic.OpenSSL, nuget< 2.4.20GitHub
  • Microsoft.Native.Quic.MsQuic.OpenSSL, nuget>= 2.5.0, < 2.5.11GitHub
  • Microsoft.Native.Quic.MsQuic.OpenSSL, nuget>= 2.6.0, < 2.6.1GitHub
  • msquicaffected: < 2.4.20CVE List
  • msquicaffected: >= 2.5.0, < 2.5.11CVE List
  • msquicaffected: >= 2.6.0, < 2.6.1CVE List
  • Microsoft.Native.Quic.MsQuic.OpenSSL, NuGetfrom first release, fixed in 2.4.20OSV
  • Microsoft.Native.Quic.MsQuic.OpenSSL, NuGet1.8.0OSV
  • Microsoft.Native.Quic.MsQuic.OpenSSL, NuGetfrom 2.5.0, fixed in 2.5.11OSV
  • Microsoft.Native.Quic.MsQuic.OpenSSL, NuGetfrom 2.6.0, fixed in 2.6.1OSV

References 14