Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected). Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.
Recommended action: Upgrade to 2.6.1, 2.5.11 or 2.4.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. Patches - Guard path promotion e0f55b5 Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
Recommended action: Upgrade to 2.5.10 or 2.4.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. Patches - Fix underflow in ACK frame parsing - 1e6e999b Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.
Recommended action: Upgrade to 2.5.7 or 2.4.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: - Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9 Workarounds Beyond upgrading to the patched versions, there is no other workaround. MSRC CVE Info https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190
Recommended action: Upgrade to 2.3.5, 2.2.7 or 2.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: - Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb Workarounds Beyond upgrading to the patched versions, there is no other workaround.
Recommended action: Upgrade to 2.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The MsQuic server application or process will crash, resulting in a denial of service. Patches The following patch was made: - Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343 Workarounds Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.
Recommended action: Upgrade to 2.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.