uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

published 2026-02-18 8mo ago modified 2026-09-10 2mo ago also CVE-2026-26995 , GO-2026-4512

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: `HelloChrome_120`

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.

Patch / fix

fixed in 1 links 1

go github.com/refraction-networking/utls 1.8.2

github.com/refraction-networking/utls@8fe0b08 commit

Is GHSA-rrxv-pmq9-x67r in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/refraction-networking/utls	>=1.6.0, <1.8.2	1.8.2

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /refraction-networking/utls/commit/8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0
web, patch
github.com /refraction-networking/utls/security/advisories/GHSA-rrxv-pmq9-x67r
web, advisory
github.com /refraction-networking/utls
package
pkg.go.dev /vuln/GO-2026-4512
web

Sources

GitHub Advisory GHSA-rrxv-pmq9-x67r
OSV GO-2026-4512

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.