CVE-2026-26995

✕ Withdrawn — historical dataLOWCVSS · not yet scored
—

uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: HelloChrome_120

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.

CVSS v3
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

February 18, 2026

Last Modified

February 18, 2026

Frequently asked(3)

What is CVE-2026-26995?
CVE-2026-26995 is a rejected CVE ID: its record was withdrawn on February 20, 2026 and no longer describes a vulnerability. Reason given: Further research determined the issue is an external dependency vulnerability.
When was the CVE record for CVE-2026-26995 published?
The CVE record for CVE-2026-26995 was published on February 18, 2026. EchelonGraph's copy of the record carries a last-modified date of February 18, 2026; the record at its source may have been updated since.
How do I remediate CVE-2026-26995?
There is nothing to remediate under CVE-2026-26995: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.