CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic.
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v4.0)
- EPSS
- 1% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- Microsoft.Native.Quic.MsQuic.OpenSSL (nuget) < 2.4.20, fixed in 2.4.20 · GHSA-w5f4-fx9m-m4q7
- Microsoft.Native.Quic.MsQuic.OpenSSL (nuget) >= 2.5.0, < 2.5.11, fixed in 2.5.11 · GHSA-w5f4-fx9m-m4q7
- Microsoft.Native.Quic.MsQuic.OpenSSL (nuget) >= 2.6.0, < 2.6.1, fixed in 2.6.1 · GHSA-w5f4-fx9m-m4q7