uTLS, a fork of Go’s crypto/tls, does not validate the downgrade canary in the ServerHello random field for TLS 1.3 handshakes. An active attacker can modify the ClientHello to omit the SupportedVersions extension, leading the server to reply with a TLS 1.2 ServerHello that contains a downgrade canary. Because uTLS does not check this canary, the client accepts the downgraded session, allowing a man‑in‑the‑middle to impersonate the server or perform fingerprinting of uTLS traffic. This flaw is a data integrity and authentication weakness identified by CWE‑693.

The vulnerability affects the refraction‑networking uTLS library in versions 1.6.7 and earlier. No other vendors or products are currently listed.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not present in the CISA KEV catalog. An attacker would need a position on the network path to alter the ClientHello, so an uncontrolled remote exploit is unlikely, yet the potential to downgrade TLS 1.3 to TLS 1.2 poses a significant risk to confidentiality and integrity for communications that rely on uTLS.