{"id":"GHSA-w67g-5rqw-f597","aliases":["GO-2026-6278"],"url":"https://o3.security/vulnerability/GHSA-w67g-5rqw-f597","summary":"Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key","details":"gorilla/websocket used `math/rand` (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections.\n\n**Type:** Use of Cryptographically Weak Pseudo-Random Number Generator\n**Fix:** Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3)\n**Credit:** bounty-hunter v6.0 silent-fix detection","published":"2026-08-24T21:00:54Z","modified":"2026-08-26T01:18:18.866684897Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/gorilla/websocket","fixedVersion":"1.5.3"}],"fix":{"url":"https://github.com/gorilla/websocket/commit/d67f41855da42d7bccd9ef050c49f7e54e783b95","label":"gorilla/websocket@d67f418"},"references":[{"type":"WEB","url":"https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597"},{"type":"WEB","url":"https://github.com/gorilla/websocket/commit/d67f41855da42d7bccd9ef050c49f7e54e783b95"},{"type":"PACKAGE","url":"https://github.com/canolgun-commits/websocket"},{"type":"WEB","url":"https://github.com/gorilla/websocket/releases/tag/v1.5.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-26T01:18:18.866684897Z"}}