{"answers":{"affected":"3 open source packages ship an affected version, including github.com/xtls/xray-core.","exploited":"There is no known exploitation of GHSA-5wf9-h793-w73c in the wild and no public exploit code.","fix":"Upgrade github.com/xtls/xray-core to 1.260327.1-0.20260710210335-64fada32b5b9 or later.","what":"GHSA-5wf9-h793-w73c is a vulnerability in github.com/xtls/xray-core, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-5wf9-h793-w73c and fix it if it is affected.\n\nWhat it is: GHSA-5wf9-h793-w73c is a vulnerability in github.com/xtls/xray-core, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-5wf9-h793-w73c in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/xtls/xray-core (Go): affected from 1.260113.0; fixed in 1.260327.1-0.20260710210335-64fada32b5b9\n- github.com/xtls/xray-core (Go): affected from 1.260113.0; fixed in 1.260327.1-0.20260710210335-64fada32b5b9\n- github.com/xtls/xray-core (Go): affected from 1.260113.0; fixed in 1.260327.1-0.20260710210335-64fada32b5b9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-5wf9-h793-w73c/ (Markdown: https://insights.sbomify.com/GHSA-5wf9-h793-w73c/index.md)","id":"GHSA-5wf9-h793-w73c","markdown":"https://insights.sbomify.com/GHSA-5wf9-h793-w73c/index.md","name":"GHSA-5wf9-h793-w73c","record":{"aliases":["GO-2026-6651"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Go networking library","requires_auth":"none","summary":"Attackers can bypass certificate pinning and perform MITM attacks when ServerName is empty in specific Xray-core TLS configurations.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nPinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.\n\n### Details\n\nhttps://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347\n\nIf `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress.\n\nIf a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections.\n\nIn Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so  ServerName can be empty.\n\nIn most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`.\n\nThanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty.\n\nHowever, there are some leftovers:\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348\n\n  `GetTLSConfig()` without `tls.WithDestination(dest)`.\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142\n\n  `GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address.\n\n  ServerName is not equivalent to SNI.\n\n  \u003e ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address.\n\nIn these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty.\n\n### PoC\n\n\u003cdetails\u003e\n\nclient.json\n```json\n{\n\t\"log\": {\n\t\t\"loglevel\": \"debug\"\n\t},\n\t\"inbounds\": [\n\t\t{\n\t\t\t\"listen\": \"127.0.0.1\",\n\t\t\t\"port\": 1080,\n\t\t\t\"protocol\": \"socks\"\n\t\t}\n\t],\n\t\"outbounds\": [\n\t\t{\n\t\t\t\"protocol\": \"hysteria\",\n\t\t\t\"settings\": {\n\t\t\t\t\"address\": \"127.0.0.1\",\n\t\t\t\t\"port\": 443,\n\t\t\t\t\"version\": 2\n\t\t\t},\n\t\t\t\"streamSettings\": {\n\t\t\t\t\"security\": \"tls\",\n\t\t\t\t\"network\": \"hysteria\",\n\t\t\t\t\"tlsSettings\": {\n\t\t\t\t\t\"pinnedPeerCertSha256\": \"e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\"\n\t\t\t\t},\n\t\t\t\t\"hysteriaSettings\": {\n\t\t\t\t\t\"version\": 2,\n\t\t\t\t\t\"auth\": \"auth\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t]\n}\n```\n\nserver.json\n```json\n{\n\t\"log\": {\n\t\t\"loglevel\": \"debug\"\n\t},\n\t\"inbounds\": [\n\t\t{\n\t\t\t\"listen\": \"127.0.0.1\",\n\t\t\t\"port\": 443,\n\t\t\t\"protocol\": \"hysteria\",\n\t\t\t\"settings\": {\n\t\t\t\t\"version\": 2\n\t\t\t},\n\t\t\t\"streamSettings\": {\n\t\t\t\t\"security\": \"tls\",\n\t\t\t\t\"network\": \"hysteria\",\n\t\t\t\t\"tlsSettings\": {\n\t\t\t\t\t\"certificates\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"certificateFile\": \"server2.crt\",\n\t\t\t\t\t\t\t\"keyFile\": \"server2.key\"\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t},\n\t\t\t\t\"hysteriaSettings\": {\n\t\t\t\t\t\"version\": 2,\n\t\t\t\t\t\"auth\": \"auth\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t],\n\t\"outbounds\": [\n\t\t{\n\t\t\t\"protocol\": \"freedom\"\n\t\t}\n\t]\n}\n```\n\nBoth `server1.crt` and `server2.crt` are issued by the same CA.\n`server1.crt` is subjected to 127.0.0.1.\n`server2.crt` is subjected to 127.0.0.2.\n\n```\nxray tls hash --cert server1.crt\nLeaf SHA256:       7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d\nCA \u003cRoot\u003e SHA256:  e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\n\nxray tls hash --cert server2.crt\nLeaf SHA256:       32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c\nCA \u003cRoot\u003e SHA256:  e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\n```\n\nserver1.crt\n```\n-----BEGIN CERTIFICATE-----\nMIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0\nMzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60\n6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K\ncZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB\nS3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI\ny344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb\ny/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw\nCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A\nAAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO\nIh36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR\nL3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD\ne6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw\nM30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy\nU5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS\n/v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ\n29bSzHij\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw\nMTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7\ndTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n\nW7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT\nZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN\n3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru\n6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36\ny0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm\nMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb\nh3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN\n/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg\nT9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir\nkXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7\n6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs\n6+IZCAM=\n-----END CERTIFICATE-----\n```\n\nserver2.crt\n```\n-----BEGIN CERTIFICATE-----\nMIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1\nMjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz\nWL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al\n1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q\nZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW\nHLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H\nORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw\nCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A\nAAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO\nIh36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm\nz7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I\nL/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5\nVn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u\nt7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7\nt5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX\nDfQWbk1o\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw\nMTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7\ndTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n\nW7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT\nZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN\n3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru\n6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36\ny0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm\nMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb\nh3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN\n/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks","id":"GHSA-5wf9-h793-w73c","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.260327.1-0.20260710210335-64fada32b5b9"],"introduced":["1.260113.0"],"last_affected":[],"package":"github.com/xtls/xray-core","purl":null,"source":"GHSA-5wf9-h793-w73c"},{"ecosystem":"Go","fixed":["1.260327.1-0.20260710210335-64fada32b5b9"],"introduced":["1.260113.0"],"last_affected":[],"package":"github.com/xtls/xray-core","purl":"pkg:golang/github.com/xtls/xray-core","source":"GHSA-5wf9-h793-w73c"},{"ecosystem":"Go","fixed":["1.260327.1-0.20260710210335-64fada32b5b9"],"introduced":["1.260113.0"],"last_affected":[],"package":"github.com/xtls/xray-core","purl":"pkg:golang/github.com/xtls/xray-core","source":"GO-2026-6651"}],"products":null,"published":"2026-10-02","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can bypass certificate pinning and perform MITM attacks when ServerName is empty in specific Xray-core TLS configurations.","url":"https://insights.sbomify.com/GHSA-5wf9-h793-w73c/"}