Detections
Analytics

SCA: security update for github.com/refraction-networking/utls (GHSA-7m29-f4hw-g2vx)

low Tenable Self-Hosted Container Security Plugin ID 437849

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still
 using it for the handshake. Versions 1.6.0 through 1.8.0 contain a fingerprint mismatch with Chrome when
 using GREASE ECH, related to cipher suite selection. When Chrome selects the preferred cipher suite in the
 outer ClientHello and for ECH, it does so consistently based on hardware support—for example, if it
 prefers AES for the outer cipher suite, it also uses AES for ECH. However, the Chrome parrot in uTLS
 hardcodes AES preference for outer cipher suites but selects the ECH cipher suite randomly between AES and
 ChaCha20. This creates a 50% chance of selecting ChaCha20 for ECH while using AES for the outer cipher
 suite, a combination impossible in Chrome. This issue only affects GREASE ECH; in real ECH, Chrome selects
 the first valid cipher suite when AES is preferred, which uTLS handles correctly. This issue has been
 fixed in version 1.8.1. (CVE-2026-27017)

See Also

https://github.com/advisories/GHSA-7m29-f4hw-g2vx

Plugin Details

Severity: Low

ID: 437849

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 2/19/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-27017

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.3

Threat Score: 0.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/18/2026

Vulnerability Publication Date: 2/18/2026

Reference Information

CVE: CVE-2026-27017