CVE-2021-4236: Uncontrolled Resource Consumption in github.com/ecnepsnai/web
Summary
CVE-2021-4236: Web vulnerable to Uncontrolled Resource Consumption. Affects github.com/ecnepsnai/web versions >= 1.4.0, < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/ecnepsnai/web is a Go package that provides a framework for building web applications. It includes features such as routing, request handling, and WebSocket support. The package is vulnerable to an issue where Web Sockets do not execute the AuthenticateMethod methods, leading to a nil pointer dereference or authentication bypass. This vulnerability affects WebSockets with an AuthenticateMethod hook, while request handlers that do not use WebSockets are not vulnerable.
Vulnerability Detail
The vulnerability arises from the failure to execute the AuthenticateMethod methods in Web Sockets. This can result in a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or it can lead to authentication bypass. The impact of this vulnerability can be severe, allowing unauthorized access or resource consumption. The vulnerability has a CVSS score of 9.8, indicating its criticality.
How To Fix
Latest published version: v1.14.0 as of 23 Oct 2026
go get github.com/ecnepsnai/web@v1.14.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
go get github.com/ecnepsnai/web@v1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by updating to the latest version of the package.
Conclusion
The github.com/ecnepsnai/web package is vulnerable to an uncontrolled resource consumption issue in Web Sockets. This can result in a nil pointer dereference or authentication bypass. It is crucial to update to version 1.5.2 or later to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ecnepsnai/web →
FAQ
The vulnerability can lead to unauthorized access or resource consumption, potentially allowing attackers to bypass authentication mechanisms.
Versions 1.4.0 to 1.5.1 of the github.com/ecnepsnai/web package are affected by this vulnerability.
No, request handlers that do not use WebSockets are not vulnerable to this issue.
Yes, updating to version 1.5.2 or later of the package will fix this vulnerability.
The CVSS score of this vulnerability is 9.8, indicating its criticality.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ecnepsnai/web.
