{"id":"EUVD-2026-93422","enisaUuid":"3606ff70-a328-3697-99ce-5da66c11f6cc","description":"MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.","datePublished":"Oct 6, 2026, 2:14:54 PM","dateUpdated":"Oct 6, 2026, 5:40:05 PM","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7\nhttps://github.com/microsoft/msquic/pull/6274\nhttps://github.com/microsoft/msquic/pull/6275\nhttps://github.com/microsoft/msquic/pull/6276\nhttps://github.com/microsoft/msquic/pull/6277\nhttps://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412\nhttps://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91\nhttps://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81\nhttps://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83\nhttps://github.com/microsoft/msquic/releases/tag/v2.4.20\nhttps://github.com/microsoft/msquic/releases/tag/v2.5.11\nhttps://github.com/microsoft/msquic/releases/tag/v2.6.1\n","aliases":"CVE-2026-105794\nGHSA-w5f4-fx9m-m4q7\n","assigner":"GitHub_M","epss":1.0,"enisaIdProduct":[{"id":"b02892b6-1eb9-32d0-9ad0-387f5daf507b","product":{"name":"msquic","vendor":{"name":"Microsoft"}},"product_version":"\u003c 2.4.20"},{"id":"b2129a71-830f-3cd5-8fb7-4356437b1384","product":{"name":"msquic","vendor":{"name":"Microsoft"}},"product_version":"2.6.0, \u003c 2.6.1"},{"id":"f2272890-8909-3a72-ad79-16f6b3a38509","product":{"name":"msquic","vendor":{"name":"Microsoft"}},"product_version":"2.5.0, \u003c 2.5.11"}],"enisaIdVendor":[{"id":"75e25488-595a-31d2-a2c4-20af6c0c7692","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"5b6ee42f-af12-34a1-ac0d-1bf16c1b61ae","vulnerability":{"id":"GHSA-w5f4-fx9m-m4q7","description":"MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL","datePublished":"Oct 6, 2026, 3:33:08 PM","dateUpdated":"Oct 6, 2026, 3:33:08 PM","baseScore":0.0,"references":"https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105794\nhttps://github.com/microsoft/msquic/pull/6274\nhttps://github.com/microsoft/msquic/pull/6275\nhttps://github.com/microsoft/msquic/pull/6276\nhttps://github.com/microsoft/msquic/pull/6277\nhttps://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412\nhttps://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91\nhttps://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81\nhttps://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83\nhttps://github.com/microsoft/msquic\nhttps://github.com/microsoft/msquic/releases/tag/v2.4.20\nhttps://github.com/microsoft/msquic/releases/tag/v2.5.11\nhttps://github.com/microsoft/msquic/releases/tag/v2.6.1\n","enisa_id":"EUVD-2026-93422\n","aliases":"CVE-2026-105794\nGHSA-w5f4-fx9m-m4q7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d54e794f-4d60-3bff-9a6b-d29a602fde34","vulnerability":{"id":"CVE-2026-105794","description":"MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.","datePublished":"Oct 6, 2026, 2:14:54 PM","dateUpdated":"Oct 6, 2026, 5:40:05 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7\nhttps://github.com/microsoft/msquic/pull/6274\nhttps://github.com/microsoft/msquic/pull/6275\nhttps://github.com/microsoft/msquic/pull/6276\nhttps://github.com/microsoft/msquic/pull/6277\nhttps://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412\nhttps://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91\nhttps://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81\nhttps://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83\nhttps://github.com/microsoft/msquic/releases/tag/v2.4.20\nhttps://github.com/microsoft/msquic/releases/tag/v2.5.11\nhttps://github.com/microsoft/msquic/releases/tag/v2.6.1\n","enisa_id":"EUVD-2026-93422\n","assigner":"GitHub_M","epss":1.0,"dataProcessed":"Nov 4, 2026, 7:15:38 AM","vulnerabilityProduct":[{"id":"6714b9d3-7813-341b-a46a-606bed158537","product":{"name":"msquic","vendor":{"name":"Microsoft"}},"product_version":"\u003c 2.4.20"},{"id":"8cdbd756-dfef-3c34-afd1-38a8b064d5e3","product":{"name":"msquic","vendor":{"name":"Microsoft"}},"product_version":"2.5.0, \u003c 2.5.11"},{"id":"f3798282-50f1-3d9c-9e50-06ddf68f53a9","product":{"name":"msquic","vendor":{"name":"Microsoft"}},"product_version":"2.6.0, \u003c 2.6.1"}],"vulnerabilityVendor":[{"id":"eb4fcba5-6c5b-3198-8e1c-b2215ff6bd0a","vendor":{"name":"Microsoft"}}]}}],"enisaIdAdvisory":[]}