MsQuic OpenSSL backend does not validate server certificate hostname
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
Microsoft MsQuic before 2.4.20, from 2.5.0 before 2.5.11, and from 2.6.0 before 2.6.1 are affected when clients use the OpenSSL or QuicTLS TLS backend. These clients do not verify that the server certificate matches the intended target hostname (CWE-295). An on-path attacker can present a certificate for another hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | msquic | before 2.4.20; 2.5.0 to before 2.5.11; 2.6.0 to before 2.6.1 | 2.4.20, 2.5.11, 2.6.1 | Patch available | CNA |
| — | Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) | before 2.4.20 | 2.4.20 | Patch available | GHSA-w5f4-fx9m-m4q7 |
| — | Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) | 2.5.0 to before 2.5.11 | 2.5.11 | Patch available | GHSA-w5f4-fx9m-m4q7 |
| — | Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) | 2.6.0 to before 2.6.1 | 2.6.1 | Patch available | GHSA-w5f4-fx9m-m4q7 |
- msquic VendorMicrosoft Affected before 2.4.20; 2.5.0 to before 2.5.11; 2.6.0 to before 2.6.1 Fixed in 2.4.20, 2.5.11, 2.6.1 Patch available CNA
- Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) Vendor— Affected before 2.4.20 Fixed in 2.4.20 Patch available GHSA-w5f4-fx9m-m4q7
- Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) Vendor— Affected 2.5.0 to before 2.5.11 Fixed in 2.5.11 Patch available GHSA-w5f4-fx9m-m4q7
- Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) Vendor— Affected 2.6.0 to before 2.6.1 Fixed in 2.6.1 Patch available GHSA-w5f4-fx9m-m4q7
Remediation
Upgrade MsQuic to 2.4.20, 2.5.11, or 2.6.1, matching the release line in use. For the NuGet package Microsoft.Native.Quic.MsQuic.OpenSSL, use 2.4.20, 2.5.11, or 2.6.1 in the same way.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA msquic (microsoft) Fixed in 2.4.20, 2.5.11, 2.6.1
- Fix · GHSA-w5f4-fx9m-m4q7 Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) Fixed in 2.4.20 Advisory →
- Fix · GHSA-w5f4-fx9m-m4q7 Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) Fixed in 2.5.11 Advisory →
- Fix · GHSA-w5f4-fx9m-m4q7 Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) Fixed in 2.6.1 Advisory →
Timeline
- 2026-10-06 Threatist record created from CVE-2026-105794
- 2026-10-06 Alias added: GHSA-w5f4-fx9m-m4q7
- 2026-10-06 Fix available: NuGet/[email protected], NuGet/[email protected], NuGet/[email protected] · GHSA-w5f4-fx9m-m4q7
- 2026-10-06 CVSS score added · GHSA-w5f4-fx9m-m4q7
- 2026-10-06 Weakness changed · GHSA-w5f4-fx9m-m4q7
- 2026-10-06 14 new references · GHSA-w5f4-fx9m-m4q7
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-06 Priority changed: MEDIUM → LOW
- 2026-10-07 Priority changed: LOW → MEDIUM
References
Other 13
- https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7
- https://github.com/microsoft/msquic/pull/6274
- https://github.com/microsoft/msquic/pull/6275
- https://github.com/microsoft/msquic/pull/6276
- https://github.com/microsoft/msquic/pull/6277
- https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412
- https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91
- https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81
- https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83
- https://github.com/microsoft/msquic/releases/tag/v2.4.20
- https://github.com/microsoft/msquic/releases/tag/v2.5.11
- https://github.com/microsoft/msquic/releases/tag/v2.6.1
- https://github.com/microsoft/msquic
More Microsoft vulnerabilities
- TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-105794 · CVE Program
- CVE-2026-105794 · NVD
- FIRST EPSS
- GHSA-w5f4-fx9m-m4q7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences