Cryptographic Weakness in Gorilla WebSocket Package: Vulnerability Overview
Summary
GO-2026-6278: Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket. Affects github.com/gorilla/websocket versions < 1.5.3. Fixed in 1.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Gorilla WebSocket package is a widely used library in the Go programming language that facilitates the implementation of WebSocket connections. It provides features such as connection management, message handling, and support for various subprotocols. The package is known for its ease of use and robust performance, making it a popular choice for developers building real-time applications. However, it has been identified that the package employs a cryptographically weak pseudo-random number generator (PRNG) for generating WebSocket mask keys, which can expose applications to security risks.
Vulnerability Detail
The vulnerability arises from the use of a weak PRNG in the Gorilla WebSocket package for generating mask keys. This weakness can allow attackers to predict the mask keys used in WebSocket communications, potentially leading to unauthorized access or manipulation of data being transmitted over the WebSocket connection. The issue is particularly critical as it can compromise the integrity and confidentiality of real-time data exchanges, making it a significant security concern for applications relying on this library.
How To Fix
Latest published version: v1.5.3 as of 23 Oct 2026
go get github.com/gorilla/websocket@v1.5.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.3
This is the first release that contains the fix.
go get github.com/gorilla/websocket@v1.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement their own secure PRNG for generating mask keys in their WebSocket implementations. However, this approach requires careful consideration to ensure that the custom implementation is secure and does not introduce additional vulnerabilities.
Conclusion
The Gorilla WebSocket package has a critical vulnerability due to the use of a weak PRNG for generating mask keys. It is essential for developers using this package to update to the patched version to mitigate security risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/gorilla/websocket →
FAQ
The Gorilla WebSocket package is a library in Go that simplifies the creation and management of WebSocket connections, allowing for real-time communication in applications.
The vulnerability involves the use of a weak PRNG for generating mask keys, which can lead to predictable keys and potential security breaches in WebSocket communications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to WebSocket communications, data manipulation, and potential exposure of sensitive information.
Yes, the vulnerability has been patched in version 1.5.3 of the Gorilla WebSocket package. It is recommended to update to this version or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gorilla/websocket.
