30 matches found
PT-2026-20790
Name of the Vulnerable Software and Affected Versions Chrome versions prior to the fix commit 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0 Description An incorrect removal of padding extension in utls for the non-pq variant of the HelloChrome 120 fingerprint. Chrome only removed this extension when...
PT-2026-20995
Name of the Vulnerable Software and Affected Versions uTLS versions 1.6.0 through 1.8.0 Description uTLS is a customized version of crypto/tls designed for fingerprinting resistance during the handshake process. Versions 1.6.0 through 1.8.0 exhibit a fingerprint mismatch with Chrome when utilizin...
EUVD-2025-12228
Malicious code in bioql PyPI...
TLS Downgrade Attack
github.com/refraction-networking/utls is vulnerable to TLS Downgrade Attack. The vulnerability is due to missing downgrade protection caused due to failure to implement and verify the downgrade canary in TLS 1.3 handshakes when using a custom ClientHello spec, allowing an attacker to force a...
GO-2025-3638 ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls
Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version e.g., TLS 1.2...
Protection Mechanism Failure
Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the ClientHandshake function, which handles ClientHello messages, and in particular the serverHello.random field. An attacker can downgrade the TLS connection from TLS 1.3 by removing the SupportedVersion...
uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries
Description Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version...
GHSA-PMC3-P9HX-JQ96 uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries
Description Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version...
PT-2025-54829
Name of the Vulnerable Software and Affected Versions utls versions prior to 1.7.0 Description The utls software did not implement the TLS 1.3 downgrade protection mechanism as specified in RFC 8446 Section 4.1.3 when a utls ClientHello specification was used. This allowed a network attacker to...
