Go/github.com/apernet/hysteria/core: unknown

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF in github.com/apernet/hysteria/core

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5809
• https://github.com/apernet/hysteria/security/advisories/GHSA-vgrc-hq28-p3xp

published 2026-07-07T15:26:32Z · modified 2026-07-07T16:01:34.690741465Z · JSON