ANT-2026-90M07PW7
Predictable WebSocket masking key and handshake nonce in HTTP.jl client
Description
The WebSocket client masking key (ws_send_frame!) and the Sec-WebSocket-Key handshake nonce (ws_random_handshake_key) were generated with rand(UInt8, n), which draws from the task-local Xoshiro256++ PRNG. Xoshiro is not cryptographically secure: its internal state can be recovered from a short run of observed outputs, and every outbound client frame exposes 4 mask bytes on the wire. An on-path observer could therefore recover the RNG state and predict all future masking keys, defeating the RFC 6455 §5.3 anti-cache-poisoning purpose of masking.
Impact
Predictable masking keys could let an on-path attacker who also supplies payload craft wire bytes that a non-conformant transparent proxy parses and caches (request/response smuggling and cache poisoning).
Patches
Fixed in HTTP.jl v2.4.0. A module-level CSPRNG (const WS_CSPRNG = Random.RandomDevice()) now generates both the 4-byte masking key and the 16-byte handshake nonce. The wire format and public API are unchanged.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
What each source reports
OSVJLSEC-2026-622 No score
Predictable WebSocket masking key and handshake nonce in HTTP.jl client
Description
The WebSocket client masking key (ws_send_frame!) and the Sec-WebSocket-Key handshake nonce (ws_random_handshake_key) were generated with rand(UInt8, n), which draws from the task-local Xoshiro256++ PRNG. Xoshiro is not cryptographically secure: its internal state can be recovered from a short run of observed outputs, and every outbound client frame exposes 4 mask bytes on the wire. An on-path observer could therefore recover the RNG state and predict all future masking keys, defeating the RFC 6455 §5.3 anti-cache-poisoning purpose of masking.
Impact
Predictable masking keys could let an on-path attacker who also supplies payload craft wire bytes that a non-conformant transparent proxy parses and caches (request/response smuggling and cache poisoning).
Patches
Fixed in HTTP.jl v2.4.0. A module-level CSPRNG (const WS_CSPRNG = Random.RandomDevice()) now generates both the 4-byte masking key and the 16-byte handshake nonce. The wire format and public API are unchanged.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
- Record
JLSEC-2026-622- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HTTPJulia |
before 2.4.0 | 2.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
ANT-2026-90M07PW7 is a vulnerability with no CVSS score yet in HTTP, published June 23, 2026. No source lists public exploit code. Fixed in HTTP 2.4.0.