GHSA-w67g-5rqw-f597 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
Attackers can predict WebSocket mask keys due to weak PRNG usage, enabling frame content injection in Go applications using Gorilla WebSocket.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-w67g-5rqw-f597?
GHSA-w67g-5rqw-f597 is a vulnerability in github.com/gorilla/websocket, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gorilla/websocket used math/rand (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections.
Type: Use of Cryptographically Weak Pseudo-Random Number Generator Fix: Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3) Credit: bounty-hunter v6.0 silent-fix detection
Which versions are affected by GHSA-w67g-5rqw-f597?
3 open source packages ship an affected version, including github.com/gorilla/websocket.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gorilla/websocket Go | All versions | 1.5.3 |
github.com/gorilla/websocket Go | All versions | 1.5.3 |
github.com/gorilla/websocket Go | All versions | 1.5.3 |
How do I fix GHSA-w67g-5rqw-f597?
Upgrade github.com/gorilla/websocket to 1.5.3 or later.
Is GHSA-w67g-5rqw-f597 being exploited?
There is no known exploitation of GHSA-w67g-5rqw-f597 in the wild and no public exploit code.
Sources
Also known as GO-2026-6278.