panic: nil pointer dereference in ScanTLS on v0.2.2 when scanning some TLS targets

Open Beginner friendly
#38 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
go
Domain
security

Research direction

Start in scanner.go at ScanTLS around line 89 and reproduce the crash against TLS targets with the affected certificate chains. Inspect how leaf is obtained before SignatureAlgorithm and PublicKeyAlgorithm are accessed. Done means those targets no longer panic and the scanner still reports TLS information normally.

Written by the indexing model from the issue text.

Description

Hi,

I encountered a crash while using RealiTLScanner v0.2.2.

The scanner successfully connects to the target and prints TLS information, but then crashes with a nil pointer dereference inside ScanTLS.

Output:

time=2026-05-26T14:33:09.505Z level=INFO msg="Connected to target" feasible=true ip=79.137.196.197 origin=79.137.196.197 tls="TLS 1.3" alpn=h2 curve=X25519 cert-length="2719(certs count: 3)" cert-signature=ECDSA-SHA256 cert-publickey=ECDSA cert-domain=github.com cert-issuer="Sectigo Limited" geo=N/A

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x90 pc=0x67f844]

goroutine 10 [running]:
main.ScanTLS(...)
/home/yu/go/src/github.com/xtls/RealiTLScanner/scanner.go:89

Environment:

OS: Linux
RealiTLScanner: v0.2.2

It looks like leaf may become nil before accessing fields like:

leaf.SignatureAlgorithm.String()
leaf.PublicKeyAlgorithm.String()

Maybe a nil check is needed before using leaf.

The issue seems reproducible on some TLS targets with specific certificate chains.

Thanks.

Dominant language
Go
Stars
4.4k
Forks
313
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from XTLS/RealiTLScanner

All issues in XTLS/RealiTLScanner

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.