GitHub Advisoryadvisory · NuGet

GHSA-w5f4-fx9m-m4q7 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

CRITICAL Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105794
Ecosystem
NuGet
Packages
Microsoft.Native.Quic.MsQuic.OpenSSL
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-295
Reviewed
2026-10-06

Affected packages

• NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: < 2.4.20 → fixed in 2.4.20 • NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: >= 2.5.0, < 2.5.11 → fixed in 2.5.11 • NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: >= 2.6.0, < 2.6.1 → fixed in 2.6.1

Description

Summary Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected). Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.

Related

Alias · CVE (1)

  • CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References