Skip to content
OpenAdvisories

Vendor

centrifugal

4 known vulnerabilities.

centrifugal at a glance

Last 12 months
4
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability, 1 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 2 vulnerabilities August 2026: 1 vulnerability, 1 critical September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202611
Jul 202620
Jun 202600
May 202600
Apr 202600
Mar 202611
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

centrifugo 4
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.1
    CVE-2026-71485

    Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeader…

    centrifugal centrifugo github.com/centrifugal/centrifugo/v4 github.com/centrifugal/centrifugo Go
  • High 8.7
    CVE-2026-62963

    Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/w…

    centrifugal centrifugo
  • High 8.2
    CVE-2026-49998

    Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup …

    centrifugal centrifugo github.com/centrifugal/centrifugo/v3 github.com/centrifugal/centrifugo/v6 Go
  • Critical 9.3
    CVE-2026-32301

    Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated at…

    centrifugal centrifugo github.com/centrifugal/centrifugo/v3 github.com/centrifugal/centrifugo/v6 Go