GO-2020-0019

    Dashboard / Vulnerabilities / GO-2020-0019

    GO-2020-0019

    Published: 14 Apr 2021Last Modified: 20 May 2024

    Summary: Integer overflow in github.com/gorilla/websocket

    Details: An attacker can craft malicious WebSocket frames that cause an integer overflow in a variable which tracks the number of bytes remaining. This may cause the server or client to get stuck attempting to read frames in a loop, which can be used as a denial of service vector.

    References: https://github.com/gorilla/websocket/pull/537, https://github.com/gorilla/websocket/commit/5b740c29263eb386f33f265561c8262522f19d37

    Affected packages

    Package

    Name: github.com/gorilla/websocket

    Purl: pkg:golang/github.com/gorilla/websocket

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.4.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2020-0019 | CVE-DB