Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

MsQuic client may accept wrong server certificate

CVE-2026-105794 · published 7 days ago
Summary

Versions of MsQuic that use the OpenSSL or QuicTLS security library fail to check that a server's certificate matches the host name you are connecting to. This lets an attacker who can intercept network traffic impersonate the intended server and read or modify data. Update to MsQuic version 2.4.20, 2.5.11, or 2.6.1, or switch to the Schannel security backend, to resolve the issue.

What to do
  • Update microsoft.native.quic.msquic.openssl to version 2.4.20.
  • Update microsoft.native.quic.msquic.openssl to version 2.5.11.
  • Update microsoft.native.quic.msquic.openssl to version 2.6.1.
Affected software
Ecosystem VendorProductAffected versions
– microsoft msquic < 2.4.20
nuget – microsoft.native.quic.msquic.openssl < 2.4.20
>= 2.5.0, < 2.5.11
>= 2.6.0, < 2.6.1
Fix: upgrade to 2.4.20
Original advisory text
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
References
Severity
9.1 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published6 Oct 2026
Updated12 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-105794 · NVD
CVE-2026-105794 · MITRE
GHSA-w5f4-fx9m-m4q7 · GHSA
CVE-2026-105794 · OSV
GHSA-w5f4-fx9m-m4q7 · OSV
Track software like this
Free during beta