{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/refraction-networking/utls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26995"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T22:33:47Z",
    "nvd_published_at": "2026-02-20T03:16:01Z",
    "severity": "LOW"
  },
  "details": "The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.\n\nAffected symbols: `HelloChrome_120`\n\nFix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0\n\nThanks to telegram @acgdaily for reporting this issue.",
  "id": "GHSA-rrxv-pmq9-x67r",
  "modified": "2026-02-27T20:37:52Z",
  "published": "2026-02-18T22:33:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/refraction-networking/utls/security/advisories/GHSA-rrxv-pmq9-x67r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/refraction-networking/utls/commit/8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/refraction-networking/utls"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2026-4512"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120"
}