CVE-2020-27813: Integer overflow in github.com/gorilla/websocket
Summary
CVE-2020-27813: Integer overflow in github.com/gorilla/websocket. Affects github.com/gorilla/websocket versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/gorilla/websocket package is a popular Go library that provides a high-level API for building WebSocket applications. It allows developers to establish WebSocket connections, send and receive messages, and handle various WebSocket-related tasks. The package is widely used in Go applications for real-time communication and interactive web features.
Vulnerability Detail
The vulnerability (CVE-2020-27813) in github.com/gorilla/websocket is an integer overflow issue. An attacker can exploit this vulnerability by crafting malicious WebSocket frames that cause an integer overflow in a variable responsible for tracking the number of bytes remaining. This can lead to the server or client getting stuck in a loop while attempting to read frames, resulting in a denial of service (DoS) condition. The impact of this vulnerability is that an attacker can disrupt the normal operation of the WebSocket communication, potentially causing service unavailability or performance degradation.
How To Fix
Latest published version: v1.5.3 as of 23 Oct 2026
go get github.com/gorilla/websocket@v1.5.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
go get github.com/gorilla/websocket@v1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the github.com/gorilla/websocket package to mitigate the risk.
Conclusion
The vulnerability (CVE-2020-27813) in the github.com/gorilla/websocket package allows for an integer overflow, leading to a denial of service (DoS) condition. To mitigate this vulnerability, it is crucial to update to version 1.4.1 or later of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/gorilla/websocket →
FAQ
The vulnerability can be exploited to cause a denial of service (DoS) condition, potentially leading to service unavailability or performance degradation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to update to the latest version of the github.com/gorilla/websocket package.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to update to the latest version to prevent potential exploitation.
This vulnerability was discovered by Max Justicz.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gorilla/websocket.
