Skip to content
fr Sign in
9.1 Critical

CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust

Description

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

Affected products and versions

Product Affected versions Fixed in
msquic 2.6 2.6.0 → < 2.6.1 2.6.1
msquic 2.5 2.5.0 → < 2.5.11 2.5.11
msquic 2.4 earliest → < 2.4.20 2.4.20

References

Timeline

  1. Published
  2. Last modified
Track this CVE