Asymmetric denial of service In microsoft.native.quic.msquic.openssl
Description
Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel
Impact
The MsQuic server application or process will crash, resulting in a denial of service.
Patches
The following patch was made:
Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343
Workarounds
Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 nuget | 2.2.3 | ||
nuget | 2.2.3 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.