{"vulnerability": "GHSA-W67G-5RQW-F597", "sightings": [{"uuid": "21303e82-a249-4f1f-ba42-2e4d288a2c64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-W67G-5RQW-F597", "type": "seen", "source": "https://gist.github.com/alon710/9348ae05ceeeb4609581f21c2822e2ed", "content": "# GHSA-W67G-5RQW-F597: GHSA-W67G-5RQW-F597: Cryptographically Weak PRNG for WebSocket Frame Masking in Gorilla WebSocket\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/GHSA-W67G-5RQW-F597\n\n## Summary\nA security vulnerability in the github.com/gorilla/websocket Go library allows remote attackers to predict client-to-server frame masking keys. This occurs because the library generates 32-bit mask keys using Go's non-cryptographically secure pseudo-random number generator (math/rand). Predicting these keys enables adversaries to bypass proxy-based security protections, facilitating HTTP request smuggling and cache poisoning attacks.\n\n## TL;DR\nGorilla WebSocket used math/rand instead of crypto/rand for masking keys, allowing attackers to predict key sequences and construct payloads that bypass proxy controls to perform request smuggling or cache poisoning.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-338\n- **Attack Vector**: Network\n- **CVSS Score**: 6.9 (Medium)\n- **EPSS Score**: N/A (No registered CVE)\n- **Impact**: HTTP Request Smuggling, Cache Poisoning\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- github.com/gorilla/websocket\n- **websocket**: < 1.5.3 (Fixed in: `1.5.3`)\n\n## Mitigation\n\n- Upgrade the dependency github.com/gorilla/websocket to v1.5.3 or higher.\n- Enforce TLS (wss://) for all WebSocket communication to encrypt payloads before they hit transit proxies.\n\n**Remediation Steps:**\n1. Verify current dependency version using 'go list -m github.com/gorilla/websocket'.\n2. Run 'go get github.com/gorilla/websocket@v1.5.3' to download the secure package.\n3. Execute 'go mod tidy' to update the dependency tracking files.\n4. Recompile and test the application to ensure compatibility.\n\n## References\n\n- [GitHub Security Advisory GHSA-W67G-5RQW-F597](https://github.com/advisories/GHSA-W67G-5RQW-F597)\n- [Vulnerability Patch Commit](https://github.com/gorilla/websocket/commit/d67f41855da42d7bccd9ef050c49f7e54e783b95)\n- [Gorilla WebSocket v1.5.3 Release Notes](https://github.com/gorilla/websocket/releases/tag/v1.5.3)\n- [Advisory Source Reference](https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-W67G-5RQW-F597) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T13:32:10.470068Z"}]}