{"id":"GO-2026-6651","aliases":["GHSA-5wf9-h793-w73c"],"title":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","summary":"Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core","severity":"none","vendor":"xtls","product":"github.com/xtls/xray-core","ecosystem":"go","affected":["github.com/xtls/xray-core >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9"],"patched":["github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T00:45:10.065378958Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6651","references":[{"url":"https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c"},{"url":"https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5"},{"url":"https://github.com/XTLS/Xray-core/pull/6472"},{"url":"https://github.com/XTLS/Xray-core/releases/tag/v26.7.11"}],"tags":["osv","go"],"ingestedAt":"2026-10-21T11:54:42.765Z","slug":"GO-2026-6651","body":"## Overview\n\nPinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core\n\n## Affected packages\n\n- `github.com/xtls/xray-core >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}