GHSA-rrxv-pmq9-x67r

Source

https://github.com/advisories/GHSA-rrxv-pmq9-x67r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-rrxv-pmq9-x67r/GHSA-rrxv-pmq9-x67r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rrxv-pmq9-x67r

Aliases

CVE-2026-26995
GO-2026-4512

Downstream

CGA (4)

Published

2026-02-18T22:33:47Z

Modified

2026-09-10T03:50:35Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

Details

The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: HelloChrome_120

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-18T22:33:47Z",
    "nvd_published_at":  "2026-02-20T03:16:01Z",
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/refraction-networking/utls

Package

Name: github.com/refraction-networking/utls; View open source insights on deps.dev
Purl: pkg:golang/github.com/refraction-networking/utls

Affected ranges

Type: SEMVER
Events: Introduced

1.6.0

Fixed

1.8.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-rrxv-pmq9-x67r/GHSA-rrxv-pmq9-x67r.json"