GHSA-w5f4-fx9m-m4q7
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-105794
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Description
# Summary Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. # Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected). ## Patches 2.6.1, 2.5.11, and 2.4.20 # Impact An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.
Paquets affectés
| Paquet | Versions |
|---|---|
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 0, fixed 2.4.20 |
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 2.5.0, fixed 2.5.11 |
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 2.6.0, fixed 2.6.1 |
Références
- https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-105794 ADVISORY
- https://github.com/microsoft/msquic/pull/6274 WEB
- https://github.com/microsoft/msquic/pull/6275 WEB
- https://github.com/microsoft/msquic/pull/6276 WEB
- https://github.com/microsoft/msquic/pull/6277 WEB
- https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412 WEB
- https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91 WEB
- https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81 WEB
- https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83 WEB
- https://github.com/microsoft/msquic PACKAGE
- https://github.com/microsoft/msquic/releases/tag/v2.4.20 WEB
- https://github.com/microsoft/msquic/releases/tag/v2.5.11 WEB
- https://github.com/microsoft/msquic/releases/tag/v2.6.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |