| Package | Affected versions | Patched versions |
|---|---|---|
| Microsoft.Native.Quic.MsQuic.OpenSSL | ≥ 2.2.0, < 2.2.7≥ 2.3.0, < 2.3.5< 2.1.12 | 2.2.72.3.52.1.12 |
| Microsoft.Native.Quic.MsQuic.Schannel | ≥ 2.2.0, < 2.2.7≥ 2.3.0, < 2.3.5< 2.1.12 | 2.2.72.3.52.1.12 |
The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.
The following patch was made:
Beyond upgrading to the patched versions, there is no other workaround.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free