GO-2026-6651

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6651

Import Source

https://vuln.go.dev/ID/GO-2026-6651.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6651

Aliases

GHSA-5wf9-h793-w73c

Published

2026-10-20T00:20:45Z

Modified

2026-11-05T23:15:11Z

Summary

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core

Details

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6651"
}

References

Affected packages

Go / github.com/xtls/xray-core

Package

Name: github.com/xtls/xray-core; View open source insights on deps.dev
Purl: pkg:golang/github.com/xtls/xray-core

Affected ranges

Type: SEMVER
Events: Introduced

1.260113.0

Fixed

1.260327.1-0.20260710210335-64fada32b5b9

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/xtls/xray-core/transport/internet/tls",
            "symbols": [
                "ApplyECH",
                "Certificate.Descriptor",
                "Certificate.ProtoReflect",
                "Certificate.String",
                "Certificate_Usage.EnumDescriptor",
                "Certificate_Usage.String",
                "Config.BuildCertificates",
                "Config.Descriptor",
                "Config.GetTLSConfig",
                "Config.ProtoReflect",
                "Config.String",
                "Conn.Close",
                "Conn.HandshakeContextServerName",
                "Conn.WriteMultiBuffer",
                "ECHCacheKey",
                "ECHConfigCache.Update",
                "ParseCurveName",
                "QueryRecord",
                "RandCarrier.Read",
                "RandCarrier.verifyPeerCert",
                "UConn.Close",
                "UConn.HandshakeContextServerName",
                "UConn.WebsocketHandshakeContext",
                "grpcUtls.ClientHandshake"
            ]
        },
        {
            "path": "github.com/xtls/xray-core/transport/internet/hysteria",
            "symbols": [
                "Config.Descriptor",
                "Config.ProtoReflect",
                "Config.String",
                "Dial",
                "Listen",
                "httpHandler.ServeHTTP",
                "httpHandler.StreamDispatcher",
                "interConn.Close",
                "interConn.Read",
                "interConn.Write"
            ]
        },
        {
            "path": "github.com/xtls/xray-core/transport/internet/grpc",
            "symbols": [
                "Config.Descriptor",
                "Config.ProtoReflect",
                "Config.String",
                "Dial",
                "Listen",
                "Listener.Close",
                "Listener.Tun",
                "Listener.TunMulti",
                "getGrpcClient"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6651.json"