Go/github.com/xtls/xray-core: unknown
Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
Action: Upgrade github.com/xtls/xray-core to 1.260327.1-0.20260710210335-64fada32b5b9 or later.
go get github.com/xtls/xray-core@v1.260327.1-0.20260710210335-64fada32b5b9Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.260113.0 | 1.260327.1-0.20260710210335-64fada32b5b9 | - |
Fixed versions
| 1.260327.1-0.20260710210335-64fada32b5b9 |
Sources
- osv: GO-2026-6651
- https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c
- https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5
- https://github.com/XTLS/Xray-core/pull/6472
- https://github.com/XTLS/Xray-core/releases/tag/v26.7.11
published · modified · JSON