{"id":"GO-2026-6651","revision":"85d092d8d36b46aea0e50da340c9f7f9","records":[{"revision":"85d092d8d36b46aea0e50da340c9f7f9","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6651","aliases":["GHSA-5wf9-h793-w73c"],"title":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","description":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","state":0,"publishedAt":"2026-10-20T00:20:45+00:00","modifiedAt":"2026-11-05T23:15:11.9146107+00:00","affected":[{"ecosystem":"Go","name":"github.com/xtls/xray-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.260113.0"},{"kind":"fixed","version":"1.260327.1-0.20260710210335-64fada32b5b9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c","https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5","https://github.com/XTLS/Xray-core/pull/6472","https://github.com/XTLS/Xray-core/releases/tag/v26.7.11"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6651","license":"OSV · upstream source license applies","key":"osv:GO-2026-6651","identifiers":["GO-2026-6651","GHSA-5wf9-h793-w73c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}