Further research determined the issue is an external dependency vulnerability.

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-26995 · CVE overview and exploitation status

GHSA-rrxv-pmq9-x67r

GO-2026-4512

cve-program · CVE-2026-26995

nvd · CVE-2026-26995

osv · GHSA-rrxv-pmq9-x67r

• https://github.com/refraction-networking/utls/security/advisories/GHSA-rrxv-pmq9-x67r
• https://github.com/refraction-networking/utls/commit/8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0
• https://github.com/refraction-networking/utls
• https://pkg.go.dev/vuln/GO-2026-4512

osv · GO-2026-4512

• https://github.com/refraction-networking/utls/security/advisories/GHSA-rrxv-pmq9-x67r
• https://github.com/refraction-networking/utls/commit/8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

No related changes are available here.