DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-W67G-5RQW-F597: GHSA-W67G-5RQW-F597: Cryptographically Weak PRNG for WebSocket Frame Masking in Gorilla WebSocket

#security #cve #cybersecurity #ghsa

GHSA-W67G-5RQW-F597: Cryptographically Weak PRNG for WebSocket Frame Masking in Gorilla WebSocket

Vulnerability ID: GHSA-W67G-5RQW-F597
CVSS Score: 6.9
Published: 2026-08-24

A security vulnerability in the github.com/gorilla/websocket Go library allows remote attackers to predict client-to-server frame masking keys. This occurs because the library generates 32-bit mask keys using Go's non-cryptographically secure pseudo-random number generator (math/rand). Predicting these keys enables adversaries to bypass proxy-based security protections, facilitating HTTP request smuggling and cache poisoning attacks.

TL;DR

Gorilla WebSocket used math/rand instead of crypto/rand for masking keys, allowing attackers to predict key sequences and construct payloads that bypass proxy controls to perform request smuggling or cache poisoning.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-338
  • Attack Vector: Network
  • CVSS Score: 6.9 (Medium)
  • EPSS Score: N/A (No registered CVE)
  • Impact: HTTP Request Smuggling, Cache Poisoning
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • github.com/gorilla/websocket
  • websocket: < 1.5.3 (Fixed in: 1.5.3)

Code Analysis

Commit: d67f418

Replace math/rand with crypto/rand to generate cryptographically secure frame mask keys.

Exploit Details

  • GitHub Security Advisory: Advisory outlining how predictable mask keys generated by math/rand permit proxy-cache poisoning and HTTP request smuggling.

Mitigation Strategies

  • Upgrade the dependency github.com/gorilla/websocket to v1.5.3 or higher.
  • Enforce TLS (wss://) for all WebSocket communication to encrypt payloads before they hit transit proxies.

Remediation Steps:

  1. Verify current dependency version using 'go list -m github.com/gorilla/websocket'.
  2. Run 'go get github.com/gorilla/websocket@v1.5.3' to download the secure package.
  3. Execute 'go mod tidy' to update the dependency tracking files.
  4. Recompile and test the application to ensure compatibility.

References

Read the full report for GHSA-W67G-5RQW-F597 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)