Aller au contenu
en Se connecter
9.1 Critique

CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust

Description

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
msquic 2.6 2.6.0 → < 2.6.1 2.6.1
msquic 2.5 2.5.0 → < 2.5.11 2.5.11
msquic 2.4 premières → < 2.4.20 2.4.20

Références

Chronologie

  1. Publiée
  2. Dernière modification
Suivre cette CVE