Skip to content
OpenAdvisories

Package · Go

github.com/gorilla/websocket

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium —
    GHSA-w67g-5rqw-f597

    Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

    gorilla/websocket used `math/rand` (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produ…

    github.com/gorilla/websocket Go
  • High 7.5
    CVE-2020-27813

    Integer overflow in github.com/gorilla/websocket

    An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

    github.com/gorilla/websocket golang-websocket Ubuntu Go