REALITY 26.9.8+ breaks qq fingerprint compatibility — critical for users affected by Russian DPI

[xkhroshkax]

Problem description

Starting with Xray-core v26.9.8, VLESS + REALITY connections using the qq uTLS fingerprint stop passing internet traffic.

This is not just a latency testing issue. Actual internet connectivity through the VPN is completely lost.

I tested several Xray-core versions with the following results:

Xray-core version	VLESS + REALITY + qq
v26.7.28	✅ Works
v26.9.8	❌ Does not work
v26.9.9	❌ Does not work
v26.9.30	❌ Does not work
v26.10.10	❌ Does not work

v26.7.28 is the latest version I've confirmed to work reliably with my configuration.

Environment

• Server OS: Ubuntu Linux (amd64)
• Management panel: 3x-ui v3.10.0
• Client: Happ (macOS/iOS)
• Protocol: VLESS + TCP + REALITY
• uTLS fingerprint: qq
• Client location: Russia
• Server locations: Russia, Germany and Latvia

Testing

My usual setup uses a Double VPN configuration:

Client → Russian server → German/Latvian server → Internet

Initially, I noticed that after upgrading Xray-core, VLESS connections stopped passing traffic, while Hysteria continued working.

To rule out issues caused by the intermediate Russian server, I also tested a direct connection to my German server:

Client → German server → Internet

The direct VLESS + REALITY connection also failed when using the qq fingerprint with a newer Xray-core version.

Switching to the chrome fingerprint did not restore connectivity either.

Downgrading Xray-core to v26.7.28 restores functionality without requiring changes to the VPN configuration.

Why this is particularly important in Russia

Due to aggressive network filtering and DPI restrictions in Russia, many TLS fingerprints appear to be blocked or unreliable.

In my particular network, qq is the only fingerprint I've found that consistently allows VLESS + REALITY connections to work.

The chrome fingerprint appears to be blocked by DPI on my network, so switching to it is not a viable workaround.

As a result, I am effectively forced to stay on Xray-core v26.7.28, even though newer versions contain improvements, security updates and bug fixes.

This is especially problematic for users in countries with aggressive internet censorship, where the choice of TLS fingerprint can determine whether a VPN connection works at all.

Possible cause

I understand that starting with Xray-core v26.9.8, REALITY introduced stricter TLS ClientHello requirements involving the X25519MLKEM768 hybrid key share.

From the related discussions, it appears that the qq fingerprint does not provide the required key share.

This seems consistent with my testing results, since v26.7.28 works while every newer version I've tested fails.

However, I cannot confirm whether this is the exact cause without further investigation.

Request

I understand that these changes may have been introduced intentionally for security reasons.

However, they appear to have unintentionally made REALITY unusable for users who depend on the qq fingerprint to bypass DPI restrictions.

Is there any possibility of restoring compatibility with the qq fingerprint, or introducing an alternative mechanism that preserves its ability to work under Russian DPI restrictions while supporting the new REALITY handshake requirements?

I'm not necessarily asking to revert the new security requirements. I'm hoping there might be a technically sound solution that allows users affected by DPI restrictions to continue using current Xray-core versions.

I'd be happy to provide additional logs, configuration details (with sensitive information removed), or perform further tests if that would help investigate this issue.

Related discussions and issues

• [Bug] fingerprint=randomized can advertise X25519MLKEM768 without an initial key share, causing uTLS to abort after a valid HRR #6714
• Unstable VPN connectivity on mobile operators v26.9.8 (works intermittently, changing fingerprint temporarily helps) #6785
• Russia blocks 2026 #6293

I've searched for similar reports and found discussions about the new REALITY handshake requirements and TLS fingerprint filtering in Russia.

However, I couldn't find a discussion specifically addressing the loss of qq compatibility in Xray 26.9.8+ and its impact on users for whom other fingerprints are not a viable alternative.

[RPRX]

#7131 (comment)

[xkhroshkax]

Thanks for the link! I've read through #7131, and the discussion about Chrome 133 fingerprint blocking in Russia is very relevant to my situation.

However, I've done some additional testing, and the issue doesn't seem to be limited to the chrome fingerprint.

Here are my results:

• Xray 26.7.28 + qq: works reliably.
• Xray 26.10.10 + qq: no internet connectivity.
• Xray 26.7.28 + firefox: works reliably.
• Xray 26.10.10 + firefox: connects and initially passes traffic, but becomes extremely unstable. Internet connectivity repeatedly drops every few seconds.
• chrome: doesn't work on my network, possibly due to Russian DPI filtering.

I've reproduced the Firefox instability when upgrading Xray-core on both my German and Russian servers independently. Downgrading to 26.7.28 restores stable connectivity.

I also tested a direct connection to my German server without the intermediate Russian server, so the issue is not limited to my Double VPN setup.

I understand that the new REALITY requirements involving X25519MLKEM768 may explain why qq no longer works, but I'm not sure why firefox also becomes unstable on newer Xray-core versions.

Could this be related to the same uTLS changes discussed in #7131, or might there be another compatibility issue introduced in newer Xray-core releases?

I'm also looking forward to the Chrome 155 fingerprint update, as it might provide a viable alternative for users affected by Russian DPI restrictions.

[RPRX]

测试结果有些奇怪，你可以试试 Xray-core 的 Safari 指纹，它也带有 MLKEM768X25519

TSPU 的行为更像是追着针对 Xray 的默认值，也就是说下一个版本 Chrome 155 指纹成为默认值后，可能不久后它也会被针对

[xkhroshkax]

Thanks for the suggestion! I've done some additional testing, including the Safari fingerprint.

I also discovered something important about my VPN client: I had actually been using Happ Plus, which has an older Xray-core version:

Happ Plus:

• App version: 4.12.0
• Xray-core: 26.3.27
• API: 3.14.0

I then found and installed the regular Happ app, which uses a newer Xray-core:

Happ:

• App version: 6.1.0
• Xray-core: 26.9.9
• API: 4.1.0

I thought the newer client-side Xray-core might resolve the compatibility issues, but unfortunately it made no noticeable difference.

I tested different Xray-core versions on my Russian server:

• 26.7.28 — works reliably.
• 26.9.8 — connections fail.
• 26.9.9 — connections fail.
• 26.9.30 — connections fail.
• 26.10.10 — connections fail.

I also tested the Chrome, Safari, and Firefox uTLS fingerprints with the newer Xray-core versions.

Unfortunately, none of them provided a stable, usable connection:

• Chrome: no working internet connection.
• Safari: no working internet connection.
• Firefox: occasionally establishes a connection and passes traffic, but becomes extremely unstable, with connectivity dropping every few seconds.
• QQ: no internet connectivity on the newer server versions.

With Xray-core 26.7.28, the previously working fingerprints provide stable connectivity.

So even after switching to a newer Happ client and testing Safari as you suggested, I still cannot reliably use any of the newer server-side Xray-core versions.

Could this indicate another compatibility issue beyond the new MLKEM768X25519 requirements, or could Russian DPI be interfering with the newer REALITY handshake behavior?

I'd be happy to perform more tests or provide diagnostic logs if that would help identify the cause.

[FunLay123]

@xkhroshkax Хай! Можешь пж чекнуть сибирскую блокировку если ещё у себя не чекал? Именно на мобильном интернете, можно через termux
https://github.com/iddserg/siberian-check

между чеками желательно ждать 130 сек и включать/отключать режим полёта дабы сеть сбросилась. Без этого блокировка одного отпечатка перекинется на следующий по очереди

Пример на моём сервере откуда я взял результаты для #7131 (comment):
./siberian-check -ip 94.249.187.12 -port 443 -fingerprint chrome -verbose -no-geoip (и потом тож самое с firefox и qq)

[xkhroshkax]

Update: The issue appears to be resolved with the Firefox fingerprint.

After additional testing, I can confirm that switching the uTLS fingerprint to firefox has resolved the connectivity issues I was experiencing with newer Xray-core versions.

I’m now running Xray-core 26.10.10 on my servers, and VLESS + REALITY connections using the firefox fingerprint are working reliably.

I tested the connection over both home Wi-Fi and mobile internet, and so far it has remained stable.

Previously, I experienced frequent disconnections with Firefox on newer Xray versions, but after further testing, those issues are no longer reproducible.

The qq fingerprint still appears incompatible with the newer REALITY requirements, while chrome remains unreliable on my network.

So the good news is that I no longer need to stay on Xray-core 26.7.28.

Thanks to everyone who helped investigate this, especially RPRX for suggesting alternative fingerprints!