{"items":[{"id":"NVI-00012933","kind":"vulnerability","title":"Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5wf9-h793-w73c"],"plain_summary":"GitHub lists this reviewed advisory for github.com/xtls/xray-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1263a4bec382055dfc2c7d5020e7c39c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1263a4bec382055dfc2c7d5020e7c39c","url":"https://github.com/advisories/GHSA-5wf9-h793-w73c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5wf9-h793-w73c","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1263a4bec382055dfc2c7d5020e7c39c"],"technology":"github.com/xtls/xray-core","known_exclusions":[],"conditions_summary":"### Summary\n\nPinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.\n\n### Details\n\nhttps://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347\n\nIf `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress.\n\nIf a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections.\n\nIn Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so  ServerName can be empty.\n\nIn most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`.\n\nThanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty.\n\nHowever, there are some leftovers:\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348\n\n  `GetTLSConfig(","public_affected_ranges":[">= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9"]}],"null_published_at":"2026-11-01T07:29:12.903Z","source_updated_at":"2026-10-02T22:35:52.000Z","source_disclosed_at":"2026-10-02T22:35:51.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:40:00.567Z"}],"next_cursor":null,"snapshot_revision":"42594"}