{"schema_version":"1.9.2","id":"GO-2026-6651","published":"2026-10-20T00:20:45Z","modified":"2026-11-05T23:15:11.914610692Z","aliases":["GHSA-5wf9-h793-w73c"],"summary":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","details":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","affected":[{"package":{"name":"github.com/xtls/xray-core","ecosystem":"Go","purl":"pkg:golang/github.com/xtls/xray-core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.260113.0"},{"fixed":"1.260327.1-0.20260710210335-64fada32b5b9"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/xtls/xray-core/transport/internet/tls","symbols":["ApplyECH","Certificate.Descriptor","Certificate.ProtoReflect","Certificate.String","Certificate_Usage.EnumDescriptor","Certificate_Usage.String","Config.BuildCertificates","Config.Descriptor","Config.GetTLSConfig","Config.ProtoReflect","Config.String","Conn.Close","Conn.HandshakeContextServerName","Conn.WriteMultiBuffer","ECHCacheKey","ECHConfigCache.Update","ParseCurveName","QueryRecord","RandCarrier.Read","RandCarrier.verifyPeerCert","UConn.Close","UConn.HandshakeContextServerName","UConn.WebsocketHandshakeContext","grpcUtls.ClientHandshake"]},{"path":"github.com/xtls/xray-core/transport/internet/hysteria","symbols":["Config.Descriptor","Config.ProtoReflect","Config.String","Dial","Listen","httpHandler.ServeHTTP","httpHandler.StreamDispatcher","interConn.Close","interConn.Read","interConn.Write"]},{"path":"github.com/xtls/xray-core/transport/internet/grpc","symbols":["Config.Descriptor","Config.ProtoReflect","Config.String","Dial","Listen","Listener.Close","Listener.Tun","Listener.TunMulti","getGrpcClient"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6651.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c"},{"type":"FIX","url":"https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5"},{"type":"WEB","url":"https://github.com/XTLS/Xray-core/pull/6472"},{"type":"WEB","url":"https://github.com/XTLS/Xray-core/releases/tag/v26.7.11"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6651"}}