xtls vulnerabilities

Products

• github.com/xtls/xray-core 1

Latest xtls CVEs

Newest publication first

1. GHSA-5wf9-h793-w73c Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

   Published 2026-10-02

   High·CVSS 7.6

   Summary Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in some cases. Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If r.Config.ServerName is empty, DNS...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.