MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

Summary Improper TLS hostname verification allows a man-in-the-middle MITM attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected the Schannel backend is not affected. Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity b...

CVE-2026-105794

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...

CVE-2026-105794

MsQuic , a cross-platform C implementation of the IETF QUIC protocol, contains an improper certificate validation vulnerability (CWE-295) in versions prior to 2.4.20, 2.5.11, and 2.6.1 . When using the OpenSSL or QuicTLS TLS backends, the software fails to verify that a server certificate matches...

EUVD-2026-93422

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...

CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...

Mageia: Security Advisory (MGASA-2025-0241)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2025-0241 Updated quictls packages with two security issues and bug fixes

Two security issues and miscellaneous minor bug fixes. Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. CVE-2025-9230 Fix Out-of-bounds read in HTTP client noproxy handling. CVE-2025-9232...

Mageia: Security Advisory (MGASA-2025-0210)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated quictls packages with minor bug fixes

Miscellaneous minor bug fixes...

MGASA-2025-0210 Updated quictls packages with minor bug fixes

Miscellaneous minor bug fixes...

Mageia: Security Advisory (MGASA-2025-0101)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2025-0101 Updated quictls packages fix security vulnerability

Timing side-channel in ECDSA signature computation. CVE-2024-13176...

Updated quictls packages fix security vulnerability

Timing side-channel in ECDSA signature computation. CVE-2024-13176...

Mageia: Security Advisory (MGASA-2024-0354)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2024-0354 Updated quictls packages fix security vulnerability

Invalid low-level GF2^m parameters can lead to an OOB memory access. CVE-2024-9143...

Updated quictls packages fix security vulnerability

Invalid low-level GF2^m parameters can lead to an OOB memory access. CVE-2024-9143...

MGASA-2024-0330 Updated quictls packages fix security vulnerabilities

The updated packages fix security vulnerabilities...

Updated quictls packages fix security vulnerabilities

The updated packages fix security vulnerabilities...

Mageia: Security Advisory (MGASA-2024-0330)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2024-0281)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...