PT-2025-54829 · Utls · Utls

Ewust · Published 2025-04-23 · Updated 2026-02-20 · CVE-2026-26994

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions utls versions prior to 1.7.0

Description The utls software did not implement the TLS 1.3 downgrade protection mechanism as specified in RFC 8446 Section 4.1.3 when a utls ClientHello specification was used. This allowed a network attacker to downgrade TLS 1.3 connections to lower versions, such as TLS 1.2, by modifying the ClientHello message to remove the SupportedVersions extension. The server would then respond with a TLS 1.2 ServerHello, including a downgrade canary in the ServerHello random field. Because utls did not validate this canary, clients accepted the downgraded connection without detection. This issue also allowed for fingerprinting of utls connections.

Recommendations Upgrade to version 1.7.0 or later.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-26994

GHSA-PMC3-P9HX-JQ96

GO-2025-3638

Affected Products

Utls

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26994.json · Exploit
• https://github.com/refraction-networking/utls/commit/f8892761e2a4d29054264651d3a86fda83bc83f9 · Patch
• https://github.com/refraction-networking/utls/pull/337 · Patch
• https://github.com/refraction-networking/utls/security/advisories/GHSA-pmc3-p9hx-jq96 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26994 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pmc3-p9hx-jq96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26994 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26994 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26994 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-26994 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3638 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26994 · Vendor Advisory
• https://github.com/refraction-networking/utls/issues/181 · Note
• https://github.com/refraction-networking/utls · Note