---
id: GO-2026-6651
aliases:
  - GHSA-5wf9-h793-w73c
title: >-
  Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of
  MITM attacks in github.com/xtls/xray-core
summary: >-
  Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of
  MITM attacks in github.com/xtls/xray-core
severity: none
vendor: xtls
product: github.com/xtls/xray-core
ecosystem: go
affected:
  - >-
    github.com/xtls/xray-core >= 1.260113.0, <
    1.260327.1-0.20260710210335-64fada32b5b9
patched:
  - github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T00:45:10.065378958Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6651'
references:
  - url: 'https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c'
  - url: >-
      https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5
  - url: 'https://github.com/XTLS/Xray-core/pull/6472'
  - url: 'https://github.com/XTLS/Xray-core/releases/tag/v26.7.11'
tags:
  - osv
  - go
ingestedAt: '2026-10-21T11:54:42.765Z'
---

## Overview

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core

## Affected packages

- `github.com/xtls/xray-core >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9`

## Remediation

Upgrade to a patched release:

- `github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9`