GHSA-j9wf-6r2x-hqmx Centrifugo v6.6.0 dependency vulnerabilities
Centrifugo server is vulnerable due to outdated Go runtime and webtransport dependencies, requiring an upgrade to mitigate critical security risks.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not stated
- Fix
- Available
What is GHSA-j9wf-6r2x-hqmx?
GHSA-j9wf-6r2x-hqmx is a vulnerability in github.com/centrifugal/centrifugo, published on 19 Feb 2026. It can be exploited over the network.
Official description
Summary
Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and
statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known
CVEs
Go standard library — compiled with Go 1.25.5:
| CVE | Severity | CVSS | Fixed In |
|---|---|---|---|
| CVE-2025-68121 | CRITICAL | 10.0 | Go 1.25.7, 1.24.13 |
| CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 |
| CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 |
| CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |
Direct dependency github.com/quic-go/webtransport-go — pinned at v0.9.0
(go.mod line 34):
| CVE | Severity | CVSS | Fixed In |
|---|---|---|---|
| CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 |
| CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 |
| CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |
Which versions are affected by GHSA-j9wf-6r2x-hqmx?
7 open source packages ship an affected version, including github.com/centrifugal/centrifugo/v6, github.com/centrifugal/centrifugo and github.com/centrifugal/centrifugo/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/centrifugal/centrifugo/v6 Go | All versions | 6.6.1 |
github.com/centrifugal/centrifugo/v6 Go | All versions | 6.6.1 |
github.com/centrifugal/centrifugo/v6 Go | All versions | 6.6.1 |
github.com/centrifugal/centrifugo Go | All versions | None |
github.com/centrifugal/centrifugo/v3 Go | All versions | None |
github.com/centrifugal/centrifugo/v4 Go | All versions | None |
1 more packages
github.com/centrifugal/centrifugo/v5 Go | All versions | None |
How do I fix GHSA-j9wf-6r2x-hqmx?
Upgrade github.com/centrifugal/centrifugo/v6 to 6.6.1 or later.
Is GHSA-j9wf-6r2x-hqmx being exploited?
There is no known exploitation of GHSA-j9wf-6r2x-hqmx in the wild and no public exploit code.
Sources
Also known as GO-2026-4528.