Microsoft MsQuic: Improper certificate hostname validation with OpenSSL/QuicTLS
Summary
MsQuic clients using the OpenSSL or QuicTLS TLS backend do not verify that the server certificate matches the intended target hostname. An on-path attacker can present a certificate for another hostname and impersonate the server in a man-in-the-middle attack. The Schannel backend is not affected.
Affected
- MsQuic before 2.4.20
- MsQuic 2.5.0 before 2.5.11
- MsQuic 2.6.0 before 2.6.1
- Affected NuGet package: Microsoft.Native.Quic.MsQuic.OpenSSL
- Only clients using the OpenSSL or QuicTLS backend; Schannel is not affected
Fixed in
- Upgrade to 2.4.20 (2.4 branch is out of support; prefer 2.5.11 or 2.6.1)
- Upgrade to 2.5.11
- Upgrade to 2.6.1
Workaround
Unknown.
Exploitation
- No public proof of concept known for this CVE.
- Not known to be exploited in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Identify applications and .NET products that use MsQuic with the OpenSSL or QuicTLS backend, including the NuGet package Microsoft.Native.Quic.MsQuic.OpenSSL.
- Update to 2.4.20, 2.5.11 or 2.6.1 depending on your release line; move off the 2.4 branch.
- Use Schannel-based builds on Windows where feasible until patched.
- Monitor for certificate warnings and unexpected server identities on untrusted networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w5f4-fx9m-m4q7 github.com
- MsQuic release v2.6.1 github.com
- MsQuic release v2.5.11 github.com
- MsQuic release v2.4.20 github.com
- Fix hostname validation with OpenSSL/QuicTLS (PR 6274) github.com
- GitLab Advisory for Microsoft.Native.Quic.MsQuic.OpenSSL advisories.gitlab.com
- OSV CVE-2026-105794 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:26.
Original description (NVD)
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
NVD references (12)
- https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412
- https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91
- https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81
- https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83
- https://github.com/microsoft/msquic/pull/6274
- https://github.com/microsoft/msquic/pull/6275
- https://github.com/microsoft/msquic/pull/6276
- https://github.com/microsoft/msquic/pull/6277
- https://github.com/microsoft/msquic/releases/tag/v2.4.20
- https://github.com/microsoft/msquic/releases/tag/v2.5.11
- https://github.com/microsoft/msquic/releases/tag/v2.6.1
- https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.