CVE-2026-62963

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/centrifugal/centrifugo/commit/46d40e4ac3a5446c9745f8b219197166ae12a6e5
https://github.com/centrifugal/centrifugo/pull/1162
https://github.com/centrifugal/centrifugo/releases/tag/v6.8.4
https://github.com/centrifugal/centrifugo/security/advisories/GHSA-q6mr-3g59-5m8x

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Centrifugo es un servidor de mensajería en tiempo real escalable de código abierto. Antes de la versión 6.8.4, el transporte WebSocket unidireccional de Centrifugo con uni_websocket.compression habilitado aplicaba uni_websocket.message_size_limit contra la longitud de la trama de cable comprimida en advanceFrame de internal/websocket/conn.go, pero ReadMessage usaba io.ReadAll después de la descompresión sin un límite de salida, permitiendo que las solicitudes no autenticadas a /connection/uni_websocket desencadenaran un gran consumo de memoria y CPU. Este problema está solucionado en la versión 6.8.4.

Information

Published : 2026-07-16 20:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-62963

Mitre link : CVE-2026-62963

CVE.ORG link : CVE-2026-62963

JSON object : View

Products Affected

No product.

CWE

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

{"id": "CVE-2026-62963", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62963", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T13:46:33.672302Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "centrifugal", "product": "centrifugo", "versions": [{"status": "affected", "version": "< 6.8.4"}]}]}], "published": "2026-07-16T20:16:47.533", "references": [{"url": "https://github.com/centrifugal/centrifugo/commit/46d40e4ac3a5446c9745f8b219197166ae12a6e5", "source": "security-advisories@github.com"}, {"url": "https://github.com/centrifugal/centrifugo/pull/1162", "source": "security-advisories@github.com"}, {"url": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-q6mr-3g59-5m8x", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4."}, {"lang": "es", "value": "Centrifugo es un servidor de mensajer\u00eda en tiempo real escalable de c\u00f3digo abierto. Antes de la versi\u00f3n 6.8.4, el transporte WebSocket unidireccional de Centrifugo con uni_websocket.compression habilitado aplicaba uni_websocket.message_size_limit contra la longitud de la trama de cable comprimida en advanceFrame de internal/websocket/conn.go, pero ReadMessage usaba io.ReadAll despu\u00e9s de la descompresi\u00f3n sin un l\u00edmite de salida, permitiendo que las solicitudes no autenticadas a /connection/uni_websocket desencadenaran un gran consumo de memoria y CPU. Este problema est\u00e1 solucionado en la versi\u00f3n 6.8.4."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}