요약
- CVE-2026-105794은(는) Microsoft.Native.Quic.MsQuic.OpenSSL에 영향을 주는 심각 (CVSS 9.1) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.0%, 전체 취약점의 62.8%보다 높음.
- 조치: 2.5.11, 2.6.1, 2.4.20 이상으로 업데이트하세요.
Description
Summary
Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic.
Details
Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected).
Patches
2.6.1, 2.5.11, and 2.4.20
Impact
An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.
NVD description
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
Microsoft.Native.Quic.MsQuic.OpenSSL의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free