Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

Fix availableCritical · CVSS 9.1EPSS 1.0%

Published Oct 6, 2026 · updated Oct 6, 2026

What to do

  1. Upgrade to a fixed version: Microsoft.Native.Quic.MsQuic.OpenSSL 2.4.20, Microsoft.Native.Quic.MsQuic.OpenSSL 2.5.11, Microsoft.Native.Quic.MsQuic.OpenSSL 2.6.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

NuGetMicrosoft.Native.Quic.MsQuic.OpenSSL

Vulnerable versions
< 2.4.20
Fixed in
2.4.20

Check your project: dotnet list package --include-transitive | grep -i Microsoft.Native.Quic.MsQuic.OpenSSL

NuGetMicrosoft.Native.Quic.MsQuic.OpenSSL

Vulnerable versions
>= 2.5.0, < 2.5.11
Fixed in
2.5.11

Check your project: dotnet list package --include-transitive | grep -i Microsoft.Native.Quic.MsQuic.OpenSSL

NuGetMicrosoft.Native.Quic.MsQuic.OpenSSL

Vulnerable versions
>= 2.6.0, < 2.6.1
Fixed in
2.6.1

Check your project: dotnet list package --include-transitive | grep -i Microsoft.Native.Quic.MsQuic.OpenSSL

Sources

CWE-295 Improper Certificate Validation

← All critical vulnerabilities