CVE-2026-26995: uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

February 18, 2026

The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: HelloChrome_120

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.

References

github.com/advisories/GHSA-rrxv-pmq9-x67r
github.com/refraction-networking/utls
github.com/refraction-networking/utls/commit/8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0
github.com/refraction-networking/utls/security/advisories/GHSA-rrxv-pmq9-x67r
nvd.nist.gov/vuln/detail/CVE-2026-26995

Code Behaviors & Features

Detect and mitigate CVE-2026-26995 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →