CVE-2020-27813: Integer overflow in github.com/gorilla/websocket
Summary
CVE-2020-27813: Integer overflow in github.com/gorilla/websocket. Affects github.com/gorilla/websocket versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/gorilla/websocket package is a popular Go library that provides a high-level API for building WebSocket applications. It is widely used for creating real-time communication channels between clients and servers. The package offers various features such as message framing, connection management, and event handling. However, a vulnerability has been discovered in the package that allows an attacker to cause a denial of service (DoS) attack on an HTTP server that accepts WebSocket connections.
Vulnerability Detail
The vulnerability arises from an integer overflow issue in the length of WebSocket frames received via a WebSocket connection. By sending specially crafted frames with a large length value, an attacker can trigger an integer overflow, leading to a DoS condition on the targeted HTTP server. This can result in the server becoming unresponsive or crashing, disrupting the availability of the service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v1.5.3 as of 23 Oct 2026
go get github.com/gorilla/websocket@v1.5.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
go get github.com/gorilla/websocket@v1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The github.com/gorilla/websocket package is vulnerable to an integer overflow issue that can be exploited to launch a DoS attack on an HTTP server. To mitigate this vulnerability, it is crucial to update the package to version 1.4.1 or later. Vulert's playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gorilla/websocket →
FAQ
The vulnerability allows an attacker to launch a DoS attack on an HTTP server that accepts WebSocket connections, potentially rendering the server unresponsive or causing it to crash.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to update the package to the fixed version to mitigate the risk.
Yes, a patch is available in version 1.4.1 of the github.com/gorilla/websocket package. It is recommended to update to this version or any subsequent releases that include the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gorilla/websocket.
