34 matches found
GHSA-W5F4-FX9M-M4Q7 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Summary Improper TLS hostname verification allows a man-in-the-middle MITM attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected the Schannel backend is not affected. Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity b...
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Summary Improper TLS hostname verification allows a man-in-the-middle MITM attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected the Schannel backend is not affected. Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity b...
CVE-2026-105794
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794
MsQuic , a cross-platform C implementation of the IETF QUIC protocol, contains an improper certificate validation vulnerability (CWE-295) in versions prior to 2.4.20, 2.5.11, and 2.6.1 . When using the OpenSSL or QuicTLS TLS backends, the software fails to verify that a server certificate matches...
EUVD-2026-93422
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
PT-2026-106751
Name of the Vulnerable Software and Affected Versions MsQuic versions prior to 2.4.20 MsQuic versions prior to 2.5.11 MsQuic versions prior to 2.6.1 Description MsQuic clients using the OpenSSL or QuicTLS TLS backends fail to properly verify that a server certificate matches the intended target...
CVE-2026-105794: Improper Certificate Validation
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
Mageia: Security Advisory (MGASA-2025-0241)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2025-0241 Updated quictls packages with two security issues and bug fixes
Two security issues and miscellaneous minor bug fixes. Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. CVE-2025-9230 Fix Out-of-bounds read in HTTP client noproxy handling. CVE-2025-9232...
Mageia: Security Advisory (MGASA-2025-0210)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2025-0210 Updated quictls packages with minor bug fixes
Miscellaneous minor bug fixes...
Updated quictls packages with minor bug fixes
Miscellaneous minor bug fixes...
Mageia: Security Advisory (MGASA-2025-0101)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2025-0101 Updated quictls packages fix security vulnerability
Timing side-channel in ECDSA signature computation. CVE-2024-13176...
Updated quictls packages fix security vulnerability
Timing side-channel in ECDSA signature computation. CVE-2024-13176...
Mageia: Security Advisory (MGASA-2024-0354)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...