GitHub Advisoryadvisory · Go

GHSA-3xh2-74w9-5vxm Integer overflow in github.com/gorilla/websocket

HIGH Published 2021-05-18 Modified 2023-02-09 Official page ↗
Aliases
CVE-2020-27813
Ecosystem
Go
Packages
github.com/gorilla/websocket
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190, CWE-400
Reviewed
2021-05-18

Affected packages

• Go github.com/gorilla/websocket: < 1.4.1 → fixed in 1.4.1

Description

An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

Related

Alias · CVE (1)

  • CVE-2020-27813 An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. vulnerability

Weakness · CWE (2)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References