GHSA-j9wf-6r2x-hqmx
Centrifugo v6.6.0 dependency vulnerabilities
GHSA-j9wf-6r2x-hqmx is a vulnerability with no CVSS score yet in github.com/centrifugal/centrifugo/v6, published February 19, 2026. No source lists public exploit code. Fixed in github.com/centrifugal/centrifugo/v6 6.6.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.6.1github.com/centrifugal/centrifugo/v6 +4 more
Description
Summary
Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and
statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known
CVEs
Go standard library — compiled with Go 1.25.5:
| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2025-68121 | CRITICAL | 10.0 | Go 1.25.7, 1.24.13 | | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |
Direct dependency github.com/quic-go/webtransport-go — pinned at v0.9.0
(go.mod line 34):
| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/centrifugal/centrifugo/v6Go | before 6.6.1 | 6.6.1 |
github.com/centrifugal/centrifugoGo | All versions | None known |
github.com/centrifugal/centrifugo/v3Go | All versions | None known |
github.com/centrifugal/centrifugo/v4Go | All versions | None known |
github.com/centrifugal/centrifugo/v5Go | All versions | None known |
What each source reports
GitHub AdvisoriesNo score
Centrifugo v6.6.0 dependency vulnerabilities
Summary
Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and
statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known
CVEs
Go standard library — compiled with Go 1.25.5:
| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2025-68121 | CRITICAL | 10.0 | Go 1.25.7, 1.24.13 | | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |
Direct dependency github.com/quic-go/webtransport-go — pinned at v0.9.0
(go.mod line 34):
| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |
- Record
GHSA-j9wf-6r2x-hqmx- Weakness
- CWE-1395
- Updated
- 2026-11-02
OSVNo score
Centrifugo v6.6.0 dependency vulnerabilities
Summary
Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and
statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known
CVEs
Go standard library — compiled with Go 1.25.5:
| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2025-68121 | CRITICAL | 10.0 | Go 1.25.7, 1.24.13 | | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |
Direct dependency github.com/quic-go/webtransport-go — pinned at v0.9.0
(go.mod line 34):
| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |
- Record
GHSA-j9wf-6r2x-hqmx- Weakness
- CWE-1395
- Updated
- 2026-11-02
OSVGO-2026-4528No score
Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo
Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo
- Record
GO-2026-4528- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.