uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries
Description
uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. In versions 1.6.7 and below, uTLS did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a uTLS ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a uTLS client to a lower TLS version (e.g., TLS 1.2) by modifying the ClientHello message to exclude the SupportedVersions extension, causing the server to respond with a TLS 1.2 ServerHello (along with a downgrade canary in the ServerHello random field). Because uTLS did not check the downgrade canary in the ServerHello random field, clients would accept the downgraded connection without detecting the attack. This attack could also be used by an active network attacker to fingerprint uTLS connections. This issue has been fixed in version 1.7.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/refraction-networking/utlsGo | < 1.7.0 | 1.7.0 |
Affected products
1- Range: < 1.7.0
Patches
1f8892761e2a4fix: add check for tls downgrade canary in utls
1 file changed · +12 −0
u_handshake_client.go+12 −0 modified@@ -538,6 +538,18 @@ func (c *UConn) clientHandshake(ctx context.Context) (err error) { return err } + // If we are negotiating a protocol version that's lower than what we + // support, check for the server downgrade canaries. + // See RFC 8446, Section 4.1.3. + maxVers := c.config.maxSupportedVersion(roleClient) + tls12Downgrade := string(serverHello.random[24:]) == downgradeCanaryTLS12 + tls11Downgrade := string(serverHello.random[24:]) == downgradeCanaryTLS11 + if maxVers == VersionTLS13 && c.vers <= VersionTLS12 && (tls12Downgrade || tls11Downgrade) || + maxVers == VersionTLS12 && c.vers <= VersionTLS11 && tls11Downgrade { + c.sendAlert(alertIllegalParameter) + return errors.New("tls: downgrade attempt detected, possibly due to a MitM attack or a broken middlebox") + } + // uTLS: do not create new handshakeState, use existing one if c.vers == VersionTLS13 { hs13 := c.HandshakeState.toPrivate13()
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-pmc3-p9hx-jq96ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-26994ghsaADVISORY
- github.com/refraction-networking/utls/commit/f8892761e2a4d29054264651d3a86fda83bc83f9ghsax_refsource_MISCWEB
- github.com/refraction-networking/utls/issues/181ghsax_refsource_MISCWEB
- github.com/refraction-networking/utls/pull/337ghsax_refsource_MISCWEB
- github.com/refraction-networking/utls/security/advisories/GHSA-pmc3-p9hx-jq96ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.