CVE-2020-27813: Integer overflow in github.com/gorilla/websocket
Summary
CVE-2020-27813: Integer overflow in github.com/gorilla/websocket. Affects github.com/gorilla/websocket versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/gorilla/websocket package is a popular Go library that provides a high-level API for building WebSocket applications. It is widely used for creating real-time communication channels between clients and servers. The package offers various features such as message framing, connection management, and event handling. However, a vulnerability has been discovered in the package that allows an attacker to cause a denial of service (DoS) attack on an HTTP server that accepts WebSocket connections.
Vulnerability Detail
The vulnerability arises from an integer overflow issue in the length of WebSocket frames received via a WebSocket connection. By sending specially crafted frames with a large length value, an attacker can trigger the overflow and cause the server to consume excessive resources or crash. This can lead to a DoS condition, rendering the server unavailable for legitimate users. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v1.5.3 as of 23 Oct 2026
go get github.com/gorilla/websocket@v1.5.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
go get github.com/gorilla/websocket@v1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the github.com/gorilla/websocket package as soon as possible.
Conclusion
In conclusion, the github.com/gorilla/websocket package is vulnerable to an integer overflow issue that can be exploited to launch a DoS attack on an HTTP server. To mitigate this vulnerability, it is crucial to update to version 1.4.1 or later of the package. Failure to do so may result in the server becoming unresponsive or crashing, impacting the availability of the application. For further assistance, please contact DevNack.com.
See every vulnerability recorded for github.com/gorilla/websocket →
FAQ
The vulnerability allows an attacker to launch a DoS attack on an HTTP server that accepts WebSocket connections. This can result in the server becoming unresponsive or crashing, rendering it unavailable for legitimate users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is important to patch your applications promptly to mitigate the risk of potential attacks.
No, the recommended mitigation is to update to the latest version of the github.com/gorilla/websocket package. This ensures that the vulnerable code is replaced with the patched code, preventing the possibility of exploitation.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. Our team of experts will be happy to help you address the issue and ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gorilla/websocket.
