CVE-2026-27017

uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. Versions 1.6.0 through 1.8.0 contain a fingerprint mismatch with Chrome when using GREASE ECH, related to cipher suite selection. When Chrome selects the preferred cipher suite in the outer ClientHello and for ECH, it does so consistently based on hardware support—for example, if it prefers AES for the outer cipher suite, it also uses AES for ECH. However, the Chrome parrot in uTLS hardcodes AES preference for outer cipher suites but selects the ECH cipher suite randomly between AES and ChaCha20. This creates a 50% chance of selecting ChaCha20 for ECH while using AES for the outer cipher suite, a combination impossible in Chrome. This issue only affects GREASE ECH; in real ECH, Chrome selects the first valid cipher suite when AES is preferred, which uTLS handles correctly. This issue has been fixed in version 1.8.1.

• CWE-1240

• https://github.com/refraction-networking/utls/security/advisories/GHSA-7m29-f4hw-g2vxPatch, Vendor Advisory

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2701Authenticated user can upload a malicious file to the server…8.8
• CVE-2026-27012OpenSTAManager is an open source management software for tec…9.8
• CVE-2026-27013Fabric.js is a Javascript HTML5 canvas library. Prior to ver…6.1
• CVE-2026-27014NanaZip is an open source file archive Starting in version 5…5.5
• CVE-2026-27015FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-27016LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…5.4
• CVE-2026-27018Gotenberg is an API for converting document formats. Prior t…7.5
• CVE-2026-2702A security flaw has been discovered in Beetel 777VR1 up to 0…3.1
• CVE-2026-27020Photobooth prior to 1.0.1 has a cross-site scripting (XSS) v…5.3
• CVE-2026-27021Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2026-27022@langchain/langgraph-checkpoint-redis is the Redis checkpoin…6.5
• CVE-2026-27023Twenty is an open source CRM. Prior to version 1.18, the SSR…5