Skip to content
OpenAdvisories

Vendor

centrifugal

4 known vulnerabilities.

Products

centrifugo 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-62963

    Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/w…

    centrifugal centrifugo
  • High 8.2
    CVE-2026-49998

    Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup …

    centrifugal centrifugo github.com/centrifugal/centrifugo/v3 github.com/centrifugal/centrifugo/v6 Go