VYPR
Get started
← All advisories
Low severityNVD Advisory· Updated Feb 20, 2026

CVE-2026-26995

CVE-2026-26995

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/refraction-networking/utlsGo
>= 1.6.0, < 1.8.21.8.2

Patches

1
8fe0b08e9a0e

fix: add missing padding extension for chrome 120

https://github.com/refraction-networking/utlsMingye ChenJan 12, 2026via ghsa
commit
1 file changed · +1 −0
  • u_parrots.go+1 −0 modified
    @@ -731,6 +731,7 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) {
 				&ApplicationSettingsExtension{SupportedProtocols: []string{"h2"}},
 				BoringGREASEECH(),
 				&UtlsGREASEExtension{},
+				&UtlsPaddingExtension{GetPaddingLen: BoringPaddingStyle},
 			}),
 		}, nil
 	// Chrome w/ Post-Quantum Key Agreement and ECH

Vulnerability mechanics

Not enough inputs (no patches or CWE) to synthesize mechanics for this CVE.

References

4

News mentions

0

No linked articles in our index yet.