gorilla github.com/gorilla/websocket vulnerabilities

Latest gorilla github.com/gorilla/websocket CVEs

Newest publication first

1. GHSA-w67g-5rqw-f597 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

   Published 2026-08-24

   Medium·CVSS 6.9

   gorilla/websocket used math/rand (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic outpu...

2. CVE-2020-27813 Integer overflow in github.com/gorilla/websocket

   Published 2020-12-02

   High·CVSS 7.5 EPSS 2.2%

   An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.