CVE-2026-105794

Name of the Vulnerable Software and Affected Versions MsQuic versions prior to 2.4.20 MsQuic versions prior to 2.5.11 MsQuic versions prior to 2.6.1

Description MsQuic clients using the OpenSSL or QuicTLS TLS backends fail to properly verify that a server certificate matches the intended target server hostname. This allows an on-path attacker to present a certificate that does not match the target hostname and spoof the server identity in a man-in-the-middle attack, where an attacker intercepts communication between two parties. The Schannel backend is not affected.

Recommendations Update to version 2.4.20. Update to version 2.5.11. Update to version 2.6.1.