Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Various vulnerabilities in MsQuic are addressed by an updated native-binary dependency update. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/470 CVSS Details - Version: 3.1 - Severity: Moderate - Score: 5.9 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness: CWE-416 (Use After Free) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.Native.Quic.MsQuic.Schannel | = 1.9.0, < 2.5.12…
Recommended action: Upgrade to 2.6.3 or 2.5.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/446 CVSS Details - Version: 3.1 - Severity: Critical - Score: 9.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-122 (Heap-based Buffer Overflow) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version…
Recommended action: Upgrade to 2.5.11-ci.159417053 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. Patches - Guard path promotion e0f55b5 Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
Recommended action: Upgrade to 2.5.10 or 2.4.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. Patches - Fix underflow in ACK frame parsing - 1e6e999b Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.
Recommended action: Upgrade to 2.5.7 or 2.4.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: - Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9 Workarounds Beyond upgrading to the patched versions, there is no other workaround. MSRC CVE Info https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190
Recommended action: Upgrade to 2.3.5, 2.2.7 or 2.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: - Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb Workarounds Beyond upgrading to the patched versions, there is no other workaround.
Recommended action: Upgrade to 2.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The MsQuic server application or process will crash, resulting in a denial of service. Patches The following patch was made: - Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343 Workarounds Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.
Recommended action: Upgrade to 2.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.