GO-2020-0019
Integer overflow in github.com/gorilla/websocket
At a glance
- Published
- Updated
- CVE
- CVE-2020-27813
- Aliases
- GHSA-3xh2-74w9-5vxm, GHSA-jf24-p9p9-4rjh
Description
An attacker can craft malicious WebSocket frames that cause an integer overflow in a variable which tracks the number of bytes remaining. This may cause the server or client to get stuck attempting to read frames in a loop, which can be used as a denial of service vector.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/gorilla/websocket | introduced 0, fixed 1.4.1 |
References
- https://github.com/gorilla/websocket/pull/537 FIX
- https://github.com/gorilla/websocket/commit/5b740c29263eb386f33f265561c8262522f19d37 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |