github.com/gorilla/websocket

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. Medium, CVSS 6.9GoAmendedPublished 24 Aug 2026

   Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

   GHSA-w67g-5rqw-f597

   Affected

   • Go github.com/gorilla/websocket < 1.5.3

   Fixed in

   1.5.3· Vendor fix available

   Issue

   gorilla/websocket used math/rand (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections. Type: Use of Cryptographically Weak Pseudo-Random Number Generator Fix: Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3) Credit: bounty-hunter v6.0 silent-fix detection

   Recommended action: Upgrade to 1.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked 26 Oct 2026, 15:28 UTCEvidence →
2. High, CVSS 7.5GoPublished 18 May 2021

   Integer overflow in github.com/gorilla/websocket

   CVE-2020-27813 · GHSA-3xh2-74w9-5vxm

   Affected

   • Go github.com/gorilla/websocket < 1.4.1

   Fixed in

   1.4.1· Vendor fix available

   Issue

   An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

   Recommended action: Upgrade to 1.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 14:59 UTCEvidence →