CVE-2026-26995
published 2026-02-24CVE-2026-26995: Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls Fingerprint vulnerability in uTLS from…
Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls
Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | refraction-networking_utls | >= 1.6.0 < 1.8.2 | 1.8.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls
osv·2026-02-24
CVE-2026-26995 Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls
Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls
Fingerprint vulnerability in uTLS from missing padding extension for Chrome 120 in github.com/refraction-networking/utls
GHSA
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
ghsa·2026-02-18
CVE-2026-26995 [LOW] CWE-200 uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.
Affected symbols: `HelloChrome_120`
Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0
Thanks to telegram @acgdaily for reporting this issue.
OSV
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
osv·2026-02-18
CVE-2026-26995 [LOW] uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.
Affected symbols: `HelloChrome_120`
Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0
Thanks to telegram @acgdaily for reporting this issue.
No detection rules found.
No public exploits indexed.
2026-02-24
Published