CVE-2026-26995

criticalrejectedpriority · track · 0US

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 9.8 · critical

Is it mine?

1 products

Who says so?

1 sources

osv

Rejected reason: Further research determined the issue is an external dependency vulnerability.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · grimoire (LLM-derived)LLM-inferred

The CWE weakness classes this flaw belongs to.

Products and version ranges known to be affected.

Go github.com/refraction-networking/utls1.6.0 → 1.8.2osvUSpkg:golang/github.com/refraction-networking/utls

Vendor and ecosystem advisories describing this.

GHSA-rrxv-pmq9-x67ruTLS has a fingerprint vulnerability from missing padding extension for Chrome 1202026-02-18ghsa · osvUS
The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension. Affected symbols: `HelloChrome_120` Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0 Thanks to telegram @acgdaily for reporting this issue.
GO-2026-4512Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls2026-02-24vendor · osvUS
Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls

Other names and identifiers for this entity.

Which sources assert this record, and when.

published 2026-02-20modified 2026-02-20

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.