{"action":"Upgrade Microsoft.Native.Quic.MsQuic.OpenSSL to 2.4.20 (2.4.x), 2.5.11 (2.5.x) or 2.6.1 (2.6.x) or later.","affected":[{"fixed":"2.4.20","introduced":"0"},{"fixed":"2.5.11","introduced":"2.5.0"},{"fixed":"2.6.1","introduced":"2.6.0"}],"component":"Microsoft.Native.Quic.MsQuic.OpenSSL","cve_ids":["CVE-2026-105794"],"ecosystem":"NuGet","epss":0.01001,"exploited":false,"fixed_versions":["2.4.20","2.5.11","2.6.1"],"ghsa_id":"GHSA-w5f4-fx9m-m4q7","id":"tcs_01M5N932J9WGSQP0R2Z1AZH2NS","modified_at":"2026-10-06T15:46:49.195357428Z","published_at":"2026-10-06T15:33:08Z","references":["https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7","https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7","https://nvd.nist.gov/vuln/detail/CVE-2026-105794","https://github.com/microsoft/msquic/pull/6274","https://github.com/microsoft/msquic/pull/6275","https://github.com/microsoft/msquic/pull/6276","https://github.com/microsoft/msquic/pull/6277","https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412","https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91","https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81","https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83","https://github.com/microsoft/msquic","https://github.com/microsoft/msquic/releases/tag/v2.4.20","https://github.com/microsoft/msquic/releases/tag/v2.5.11","https://github.com/microsoft/msquic/releases/tag/v2.6.1"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-w5f4-fx9m-m4q7","url":"https://osv.dev/vulnerability/GHSA-w5f4-fx9m-m4q7"},{"source":"nvd","source_id":"CVE-2026-105794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105794"}],"summary":"MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL"}