v2.5.21: certificate pinning detection, open .fxzy files on Linux, and a .NET security update

Fluxzy Desktop 2.5.21 is a maintenance release. It makes certificate pinning visible instead of silent, finishes the Linux file association, and ships a patched .NET runtime. Here is what changed since 2.5.8.

The fluxzyd backend ships its own copy of the .NET runtime. A patched runtime installed on your machine does not protect it. Release 2.5.8 bundled runtime 10.0.10, which is affected by CVE-2026-111497, a buffer overflow in the Brotli decoder. Fluxzy uses that decoder for every response sent with Content-Encoding: br, so a malicious server could target it.

Microsoft fixed the issue in the 10.0.14 out-of-band release of October 25, 2026. Fluxzy Desktop 2.5.21 bundles that runtime on every platform. The build now pins the runtime version and fails if an installer would ship an older one. Update as soon as you can.

Some applications refuse the interception certificate during the TLS handshake. Mobile apps and telemetry SDKs do this often. Until now, the only trace in Fluxzy was a tunnel row with no request, no bytes and no explanation. It was easy to miss.

Fluxzy now detects this pattern. A CONNECT or SOCKS5 tunnel with no upstream connection, no bytes, and no decrypted exchange to the same host within 10 seconds is marked as a dead tunnel. The exchange table shows a yellow shield on that row instead of the status bullet. The detail panel shows a banner that explains the verdict and suggests a rule that skips SSL decryption for the host. If the host does not matter to your test, that rule lets the app talk to the server directly and keeps the rest of your capture clean.

Detection runs during live capture and on opened archives. A tunnel younger than 10 seconds is never flagged, so a connection still being negotiated does not raise a false alarm.

Double-clicking a .fxzy archive now opens it in Fluxzy Desktop on deb and rpm installs. The package ships a shared MIME definition for the format, and the desktop entry passes the clicked file to the app. Post-install hooks refresh the MIME and desktop databases, so the association works right after installation.

The Linux packages are also available from the apt and dnf repository. See the download page for the setup commands.

Requests that never received a response were saved by older Fluxzy.Core builds without a connection ID. Their packets still sit in the pcapng of the connection that carried them, but the Connection tab could not find it.

Fluxzy now infers the connection. It looks at the captured connections to the same host that were open when the request was received, then keeps the one whose wire shows request bytes leaving at that moment with no other exchange claiming them. The Connection tab and the exchange header use the result, so the PCAP open and download buttons work for these exchanges. An "inferred" badge tells you the link was reconstructed. That badge is deliberately discreet, so it does not compete with the stored connections.

The same resolution is exposed to the built-in MCP server through fluxzy_pcap_find_connection, and fluxzy_pcap_correlate_exchange falls back to it.

The banner introduced above uses a neutral panel style. It reads as information, not as an error.

• Startup race: On a fast machine the backend could signal readiness before the UI had attached its listener. The event was lost and the app stayed on the splash screen. The listener is now registered first, and the state is re-checked once everything is wired.
• Connectivity tab: Exchanges recorded without an upstream connection, such as mocked responses or transport errors, showed a permanent "Loading data" state. They now show "No connection data available".
• Filter bar rendering: Toolbar filter buttons and a few other lists were rebuilt on every state update. They are now tracked by stable keys, which removes needless re-rendering.

This release updates Fluxzy.Core to 1.39.52. Two changes are worth noting:

• Bytes pipelined right behind a CONNECT header are now replayed to the TLS handshake and to blind tunnels, so clients that send early data no longer stall.
• On Windows, the system proxy is registered for http and https only. Other protocols are left alone.

---

Fluxzy Desktop 2.5.21 is available now for Windows, macOS, and Linux. Download it here.

Found a bug or have a feature request? Open an issue on GitHub.