PT-2026-20995 · Google+1 · Google Chrome+1

Telegram@Acgdaily · Published 2026-02-18 · Updated 2026-05-30 · CVE-2026-27017

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions uTLS versions 1.6.0 through 1.8.0

Description uTLS is a customized version of crypto/tls designed for fingerprinting resistance during the handshake process. Versions 1.6.0 through 1.8.0 exhibit a fingerprint mismatch with Chrome when utilizing GREASE ECH due to inconsistencies in cipher suite selection. Specifically, Chrome consistently bases its cipher suite choices on hardware support—preferring AES for both the outer cipher suite and ECH if AES is preferred. However, uTLS’s implementation hardcodes an AES preference for outer cipher suites but randomly selects between AES and ChaCha20 for ECH. This can result in a combination of AES for the outer suite and ChaCha20 for ECH, which is not possible in Chrome. This issue is limited to GREASE ECH and does not affect standard ECH configurations, as uTLS correctly handles the first valid cipher suite when AES is preferred in those cases.

Recommendations Update to uTLS version 1.8.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-1240

Related Identifiers

CVE-2026-27017

GHSA-7M29-F4HW-G2VX

GO-2026-4509

OPENSUSE-SU-2026:10913-1

SUSE-SU-2026:0757-1

Affected Products

Google Chrome

Utls

References · 123

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27017.json · Exploit
• https://github.com/refraction-networking/utls/security/advisories/GHSA-7m29-f4hw-g2vx · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27017 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27017 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7m29-f4hw-g2vx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27017 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10913-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27017 · Security Note
• https://osv.dev/vulnerability/GO-2026-4509 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/refraction-networking/utls/releases/tag/v1.8.1 · Note
• https://github.com/refraction-networking/utls/commit/24bd1e05a788c1add7f3037f4532ea552b2cee07 · Note
• https://github.com/refraction-networking/utls · Note
• https://suse.com/security/cve/CVE-2017-18916 · Note