Summary
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Advisory details
Summary
Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic.
Details
Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected).
Patches
2.6.1, 2.5.11, and 2.4.20
Impact
An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.
References
- https://github.com/advisories/GHSA-w5f4-fx9m-m4q7
- https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7
- https://nvd.nist.gov/vuln/detail/CVE-2026-105794
- https://github.com/microsoft/msquic/pull/6274
- https://github.com/microsoft/msquic/pull/6275
- https://github.com/microsoft/msquic/pull/6276
- https://github.com/microsoft/msquic/pull/6277
- https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-96222
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
- MEDIUMCVE-2026-70194
Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability
- HIGHCVE-2026-103921
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
- HIGHCVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
- HIGHCVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
- HIGHCVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool