[Nashit-h]

dns.asyncquery.quic() merges the deprecated server_hostname alias into hostname and then builds the QUIC manager with server_name=server_hostname, so a call made with the documented hostname= form hands aioquic no name at all. aioquic only matches the certificate against a name or IP address when server_name is set, so with hostname= any certificate chaining to the trusted CAs was accepted whatever name or address it carried, and an on-path attacker holding any CA-issued certificate could impersonate the DoQ server. dns.query.quic() passes hostname and is not affected; the async function has had the parameter since 2.8.0.

Repro against the nano nameserver, whose certificate is for localhost: dns.query.quic(q, "127.0.0.1", port=port, verify=ca, hostname="wrong.example") fails the handshake, while await dns.asyncquery.quic(...) with the same arguments returns the answer. The new test_hostname_* tests in tests/test_doq.py cover sync, asyncio and trio, and the two async ones fail before the change. NO_INTERNET=1 pytest passes, and black, ruff, pyright and ty report nothing new.