CVE-2026-26995
NoneCVSS
—
EPSS
—
Published
Feb 20, 2026
CISA due date
—
The record
Rejected reason: Further research determined the issue is an external dependency vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/refraction-networking/utls | 1.6.0 | 1.8.2 |
| Chainguard | nuclei | 0 | 3.7.0-r5 |
| Wolfi | nuclei | 0 | 3.7.0-r5 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4509 Fingerprint vulnerability in uTLS from GREASE ECH mismatch for Chrome parrots in… Also affects github.com/refraction-networking/utls
- CVE-2026-27017 uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting… Also affects github.com/refraction-networking/utls
- CVE-2026-26994 uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting… Also affects github.com/refraction-networking/utls
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects nuclei
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects nuclei
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects nuclei
- CVE-2026-32287 Boolean XPath expressions that evaluate to true can cause an infinite loop in… Also affects nuclei
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects nuclei