GHSA-5wf9-h793-w73c: Xray-core Remote Code Execution Vulnerability
HIGH
CWE-297
Published
Advisory Summary
GHSA-5wf9-h793-w73c is a HIGH remote code execution vulnerability (CWE-297: Improper Validation of Certificate with Host Mismatch) affecting Xray-core libraries in the Go ecosystem. The issue involves pinning a ca certificate via pinnedpeercertsha256 can lead to the success of mitm attacks. Remediation is available by upgrading affected packages to version 1.260327.1-0.20260710210335-64fada32b5b9.
GHSA-5wf9-h793-w73c at a Glance
CVE Identifier
N/A
GHSA Identifier
GHSA-5wf9-h793-w73c
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-297: Improper Validation of Certificate with Host Mismatch
Affected Product
Xray-core
Package Ecosystem
Go
Published Date
Last Updated
How to Fix GHSA-5wf9-h793-w73c
To remediate this vulnerability, upgrade all affected Xray-core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/xtls/xray-core
fixed: 1.260327.1-0.20260710210335-64fada32b5b9
Upgrade github.com/xtls/xray-core to 1.260327.1-0.20260710210335-64fada32b5b9
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/xtls/xray-coreHow to Check if You Are Affected
To determine whether your application is affected by GHSA-5wf9-h793-w73c, inspect your project dependencies for Xray-core:
inspect dependencies for github.com/xtls/xray-coreAnalyze the terminal output to locate any version of Xray-core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.260327.1-0.20260710210335-64fada32b5b9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-297: Improper Validation of Certificate with Host Mismatch, where the product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host. In Xray-core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
Pinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.
### Details
https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347
If `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress.
If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections.
In Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so ServerName can be empty.
In most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`.
Thanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty.
However, there are some leftovers:
- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348
`GetTLSConfig()` without `tls.WithDestination(dest)`.
- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142
`GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address.
ServerName is not equivalent to SNI.
> ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address.
In these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty.
### PoC
<details>
client.json
```json
{
"log": {
"loglevel": "debug"
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 1080,
"protocol": "socks"
}
],
"outbounds": [
{
"protocol": "hysteria",
"settings": {
"address": "127.0.0.1",
"port": 443,
"version": 2
},
"streamSettings": {
"security": "tls",
"network": "hysteria",
"tlsSettings": {
"pinnedPeerCertSha256": "e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f"
},
"hysteriaSettings": {
"version": 2,
"auth": "auth"
}
}
}
]
}
```
server.json
```json
{
"log": {
"loglevel": "debug"
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 443,
"protocol": "hysteria",
"settings": {
"version": 2
},
"streamSettings": {
"security": "tls",
"network": "hysteria",
"tlsSettings": {
"certificates": [
{
"certificateFile": "server2.crt",
"keyFile": "server2.key"
}
]
},
"hysteriaSettings": {
"version": 2,
"auth": "auth"
}
}
}
],
"outbounds": [
{
"protocol": "freedom"
}
]
}
```
Both `server1.crt` and `server2.crt` are issued by the same CA.
`server1.crt` is subjected to 127.0.0.1.
`server2.crt` is subjected to 127.0.0.2.
```
xray tls hash --cert server1.crt
Leaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d
CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f
xray tls hash --cert server2.crt
Leaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c
CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f
```
server1.crt
```
-----BEGIN CERTIFICATE-----
MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0
MzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60
6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K
cZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB
S3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI
y344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb
y/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A
AAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO
Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR
L3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD
e6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw
M30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy
U5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS
/v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ
29bSzHij
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw
MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7
dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n
W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT
ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN
3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru
6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36
y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb
h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN
/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg
T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir
kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7
6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs
6+IZCAM=
-----END CERTIFICATE-----
```
server2.crt
```
-----BEGIN CERTIFICATE-----
MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1
MjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz
WL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al
1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q
ZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW
HLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H
ORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A
AAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO
Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm
z7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I
L/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5
Vn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u
t7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7
t5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX
DfQWbk1o
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw
MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7
dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n
W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT
ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN
3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru
6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36
y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb
h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN
/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg
T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir
kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7
6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs
6+IZCAM=
-----END CERTIFICATE-----
```
server2.key
```
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCY7k8ekjoME6rm
zlkxs03+YkN5ykcmAh8qZnMgyygEmlfZ+vqA81i/S6fYkeLjqzsjq9unrvG7nf8g
ZxYkc/KQD++IsYxSD/LYA2XknuK6/+IwCovwJdToUEo7ysmiKUs+LjOB9/XUMA8i
9oSZyg2JlGuyefNm9hIGFO766Omb4nwiIf4tKmSIFTiXVpI0/sfMQMX6lt/4QtHA
NNwI3N1wTxARjkwEmXGvCE9dLHYFIgRjBzHgVhyy88/POxHaT5/OuLMuXEI+dPXp
BD+43NxAcZ8cKasqpLa/kPofBMVjOwlSMvWfhzkU9k8c8Xn6GBWNvGuj+1SdjTZ0
SRYCKT39AgMBAAECggEABa+oq/GSbHQHwPSvrtAkqH51VVAu1Iw0JfKwuamsF324
of95tHU32ccBmuUTu1TYylL/xAyWatwtSgJjOaBBBte814eIeN2kcSExNu6sbfkJ
KzGdMeTqNWgU1oPL+vZPmKSFoEG8t3LBAVMKq6AuYCzvUy/DG9Mu6OB64UPrObND
neXZT8YZ2Ux0vEV9BAc0z+9tdWVjBy+l5ei6wpjhP69GZiVOsLmKTg/MDT4FN+Pi
WJbyHcL1IKTRxxNxDPInBKhEMrxKKAABeXlp5nwnz0gkgUoxK3YHZmxAPr6yCcHP
ffeMjpE5BaRKzhimKrOJB4LUES24ltjo+5v5GmZzYQKBgQDSbhiNQpmhOk4ICzwJ
8DMCAigaDm2cD/qC66OFrHhQfr7EC9MRKKC/8WlZYgNepxZ1ZM95+GJu5aTsh7d2
HknwJkxkbTadfRcch9HQun68Y814G0LBDuDRRc9OnBQW6Gr4jTFDP+uqQl6gAfu4
QOjATymrRa5S/21MkQ3Ryb5H4QKBgQC6DI1ETmfvXCOVpEUM9IjeEbiAjVYbUjBL
GEOhE0izOv8mjSEgifMSEXJMn58F4nW/UoxtDobTAhQ/WO5BUVCEeQnOAXhV57jU
/t/fBbdC7nrVnfFl9KmsOV3LcxUo0yE/x7UiHd1QlwtOTl1KPFQa9WpSehxjjQAS
mHYM5PhJnQKBgQCIGHCEm/hkkCL7jNiNzO4QdHifMYmuj58DoYcm4z8FQJP8k3E0
/cPJoEb0ajGnvAUIc+TEC+MNujSKTdRX7or/aKWrpf7WqJqT9zu59YQWL64p6eeo
mQjKEI5dVxCfKD5W9mpQBj1S5o3wipfUuRZPmmNmxDBUuaJlDMOVVRddwQKBgCUl
bmst8GiFEAHHq5W7mTwlc54PGhsYXNYRgSc+72wBooHy+aNCh8qauyR7VkfZgELz
21/G37pvltVTDzbxYk8gz4lXF8ynGGtGfDJONNnjPZk7EMCXiez+AzEkyBu/k8rl
N9AZAGAf2D0JPm0dAHnleBYBlXt24oXT9PX8HWqtAoGBALRX6V1U+bKwMih3N21b
1w/ELI7L1BBAPqJxiQPSOa7kshamZgFenbH1wFLIXz6YwaEOOmYiId6lFjcJaBbF
+R4HfxBhOuY6cvD0vEROIRntaqsj4zJXahlZZ9uG1EAYrY2tGKkCUMKN2IBE+WWS
3YTH4WIOsCZriuaHIAyjsCcv
-----END PRIVATE KEY-----
```
</details>
Expected behavior: The client will fail to establish the connection.
Actual behavior: The client succeeds in establishing the connection.
### Impact
Xray-core from v26.1.13 to the latest version
GHSA-5wf9-h793-w73c Affected Xray-core Versions
1 component(s)
Fixed Versions:
1.260327.1-0.20260710210335-64fada32b5b9
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/xtls/xray-core
|
Go |
≥ 1.260113.0
< 1.260327.1-0.20260710210335-64fada32b5b9
|
1.260327.1-0.20260710210335-64fada32b5b9
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c
Xray-core Source Repository
REPOSITORY
https://github.com/XTLS/Xray-core/pull/6472
Security Fix Commit
FIX COMMIT
https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5
Xray-core Source Repository
REPOSITORY
https://github.com/XTLS/Xray-core
Xray-core Release
RELEASE
https://github.com/XTLS/Xray-core/releases/tag/v26.7.11
Frequently Asked Questions
What is GHSA-5wf9-h793-w73c?
GHSA-5wf9-h793-w73c is a security vulnerability in Xray-core involving Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks under CWE-297: Improper Validation of Certificate with Host Mismatch.
Which Xray-core versions are affected?
Affected versions include releases prior to 1.260327.1-0.20260710210335-64fada32b5b9 across affected packages: github.com/xtls/xray-core.
What version fixes GHSA-5wf9-h793-w73c?
Upgrading to 1.260327.1-0.20260710210335-64fada32b5b9 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/xtls/xray-core affected?
Yes, github.com/xtls/xray-core is affected in releases prior to 1.260327.1-0.20260710210335-64fada32b5b9. Upgrade your dependency to 1.260327.1-0.20260710210335-64fada32b5b9 or later.
What CWE is associated with GHSA-5wf9-h793-w73c?
GHSA-5wf9-h793-w73c is classified under CWE-297: Improper Validation of Certificate with Host Mismatch (The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.).
How can I check Go dependencies for GHSA-5wf9-h793-w73c?
Run the dependency tree command: 'inspect dependencies for github.com/xtls/xray-core'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-5wf9-h793-w73c",
"modified" : "2026-10-02T22:35:51Z",
"published" : "2026-10-02T22:35:51Z",
"aliases" : [ ],
"summary" : "Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks",
"details" : "### Summary\n\nPinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.\n\n### Details\n\nhttps://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347\n\nIf `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress.\n\nIf a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections.\n\nIn Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so ServerName can be empty.\n\nIn most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`.\n\nThanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty.\n\nHowever, there are some leftovers:\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348\n\n `GetTLSConfig()` without `tls.WithDestination(dest)`.\n\n- https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142\n\n `GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address.\n\n ServerName is not equivalent to SNI.\n\n > ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address.\n\nIn these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty.\n\n\n### PoC\n\n<details>\n\nclient.json\n```json\n{\n\t\"log\": {\n\t\t\"loglevel\": \"debug\"\n\t},\n\t\"inbounds\": [\n\t\t{\n\t\t\t\"listen\": \"127.0.0.1\",\n\t\t\t\"port\": 1080,\n\t\t\t\"protocol\": \"socks\"\n\t\t}\n\t],\n\t\"outbounds\": [\n\t\t{\n\t\t\t\"protocol\": \"hysteria\",\n\t\t\t\"settings\": {\n\t\t\t\t\"address\": \"127.0.0.1\",\n\t\t\t\t\"port\": 443,\n\t\t\t\t\"version\": 2\n\t\t\t},\n\t\t\t\"streamSettings\": {\n\t\t\t\t\"security\": \"tls\",\n\t\t\t\t\"network\": \"hysteria\",\n\t\t\t\t\"tlsSettings\": {\n\t\t\t\t\t\"pinnedPeerCertSha256\": \"e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\"\n\t\t\t\t},\n\t\t\t\t\"hysteriaSettings\": {\n\t\t\t\t\t\"version\": 2,\n\t\t\t\t\t\"auth\": \"auth\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t]\n}\n```\n\nserver.json\n```json\n{\n\t\"log\": {\n\t\t\"loglevel\": \"debug\"\n\t},\n\t\"inbounds\": [\n\t\t{\n\t\t\t\"listen\": \"127.0.0.1\",\n\t\t\t\"port\": 443,\n\t\t\t\"protocol\": \"hysteria\",\n\t\t\t\"settings\": {\n\t\t\t\t\"version\": 2\n\t\t\t},\n\t\t\t\"streamSettings\": {\n\t\t\t\t\"security\": \"tls\",\n\t\t\t\t\"network\": \"hysteria\",\n\t\t\t\t\"tlsSettings\": {\n\t\t\t\t\t\"certificates\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"certificateFile\": \"server2.crt\",\n\t\t\t\t\t\t\t\"keyFile\": \"server2.key\"\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t},\n\t\t\t\t\"hysteriaSettings\": {\n\t\t\t\t\t\"version\": 2,\n\t\t\t\t\t\"auth\": \"auth\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t],\n\t\"outbounds\": [\n\t\t{\n\t\t\t\"protocol\": \"freedom\"\n\t\t}\n\t]\n}\n```\n\nBoth `server1.crt` and `server2.crt` are issued by the same CA.\n`server1.crt` is subjected to 127.0.0.1.\n`server2.crt` is subjected to 127.0.0.2.\n\n```\nxray tls hash --cert server1.crt\nLeaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d\nCA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\n\nxray tls hash --cert server2.crt\nLeaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c\nCA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f\n```\n\nserver1.crt\n```\n-----BEGIN CERTIFICATE-----\nMIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0\nMzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60\n6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K\ncZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB\nS3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI\ny344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb\ny/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw\nCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A\nAAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO\nIh36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR\nL3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD\ne6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw\nM30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy\nU5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS\n/v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ\n29bSzHij\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw\nMTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7\ndTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n\nW7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT\nZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN\n3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru\n6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36\ny0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm\nMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb\nh3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN\n/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg\nT9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir\nkXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7\n6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs\n6+IZCAM=\n-----END CERTIFICATE-----\n```\n\nserver2.crt\n```\n-----BEGIN CERTIFICATE-----\nMIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1\nMjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz\nWL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al\n1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q\nZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW\nHLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H\nORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw\nCwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A\nAAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO\nIh36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm\nz7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I\nL/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5\nVn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u\nt7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7\nt5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX\nDfQWbk1o\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL\nBQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw\nMTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7\ndTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n\nW7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT\nZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN\n3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru\n6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36\ny0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm\nMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb\nh3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN\n/l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg\nT9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir\nkXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7\n6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs\n6+IZCAM=\n-----END CERTIFICATE-----\n```\n\nserver2.key\n```\n-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCY7k8ekjoME6rm\nzlkxs03+YkN5ykcmAh8qZnMgyygEmlfZ+vqA81i/S6fYkeLjqzsjq9unrvG7nf8g\nZxYkc/KQD++IsYxSD/LYA2XknuK6/+IwCovwJdToUEo7ysmiKUs+LjOB9/XUMA8i\n9oSZyg2JlGuyefNm9hIGFO766Omb4nwiIf4tKmSIFTiXVpI0/sfMQMX6lt/4QtHA\nNNwI3N1wTxARjkwEmXGvCE9dLHYFIgRjBzHgVhyy88/POxHaT5/OuLMuXEI+dPXp\nBD+43NxAcZ8cKasqpLa/kPofBMVjOwlSMvWfhzkU9k8c8Xn6GBWNvGuj+1SdjTZ0\nSRYCKT39AgMBAAECggEABa+oq/GSbHQHwPSvrtAkqH51VVAu1Iw0JfKwuamsF324\nof95tHU32ccBmuUTu1TYylL/xAyWatwtSgJjOaBBBte814eIeN2kcSExNu6sbfkJ\nKzGdMeTqNWgU1oPL+vZPmKSFoEG8t3LBAVMKq6AuYCzvUy/DG9Mu6OB64UPrObND\nneXZT8YZ2Ux0vEV9BAc0z+9tdWVjBy+l5ei6wpjhP69GZiVOsLmKTg/MDT4FN+Pi\nWJbyHcL1IKTRxxNxDPInBKhEMrxKKAABeXlp5nwnz0gkgUoxK3YHZmxAPr6yCcHP\nffeMjpE5BaRKzhimKrOJB4LUES24ltjo+5v5GmZzYQKBgQDSbhiNQpmhOk4ICzwJ\n8DMCAigaDm2cD/qC66OFrHhQfr7EC9MRKKC/8WlZYgNepxZ1ZM95+GJu5aTsh7d2\nHknwJkxkbTadfRcch9HQun68Y814G0LBDuDRRc9OnBQW6Gr4jTFDP+uqQl6gAfu4\nQOjATymrRa5S/21MkQ3Ryb5H4QKBgQC6DI1ETmfvXCOVpEUM9IjeEbiAjVYbUjBL\nGEOhE0izOv8mjSEgifMSEXJMn58F4nW/UoxtDobTAhQ/WO5BUVCEeQnOAXhV57jU\n/t/fBbdC7nrVnfFl9KmsOV3LcxUo0yE/x7UiHd1QlwtOTl1KPFQa9WpSehxjjQAS\nmHYM5PhJnQKBgQCIGHCEm/hkkCL7jNiNzO4QdHifMYmuj58DoYcm4z8FQJP8k3E0\n/cPJoEb0ajGnvAUIc+TEC+MNujSKTdRX7or/aKWrpf7WqJqT9zu59YQWL64p6eeo\nmQjKEI5dVxCfKD5W9mpQBj1S5o3wipfUuRZPmmNmxDBUuaJlDMOVVRddwQKBgCUl\nbmst8GiFEAHHq5W7mTwlc54PGhsYXNYRgSc+72wBooHy+aNCh8qauyR7VkfZgELz\n21/G37pvltVTDzbxYk8gz4lXF8ynGGtGfDJONNnjPZk7EMCXiez+AzEkyBu/k8rl\nN9AZAGAf2D0JPm0dAHnleBYBlXt24oXT9PX8HWqtAoGBALRX6V1U+bKwMih3N21b\n1w/ELI7L1BBAPqJxiQPSOa7kshamZgFenbH1wFLIXz6YwaEOOmYiId6lFjcJaBbF\n+R4HfxBhOuY6cvD0vEROIRntaqsj4zJXahlZZ9uG1EAYrY2tGKkCUMKN2IBE+WWS\n3YTH4WIOsCZriuaHIAyjsCcv\n-----END PRIVATE KEY-----\n```\n\n</details>\n\nExpected behavior: The client will fail to establish the connection.\n\nActual behavior: The client succeeds in establishing the connection.\n\n### Impact\n\nXray-core from v26.1.13 to the latest version",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/xtls/xray-core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.260113.0"
}, {
"fixed" : "1.260327.1-0.20260710210335-64fada32b5b9"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c"
}, {
"type" : "WEB",
"url" : "https://github.com/XTLS/Xray-core/pull/6472"
}, {
"type" : "WEB",
"url" : "https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/XTLS/Xray-core"
}, {
"type" : "WEB",
"url" : "https://github.com/XTLS/Xray-core/releases/tag/v26.7.11"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-297" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-02T22:35:51Z",
"nvd_published_at" : null
}
}