{"id":"ANT-2026-90M07PW7","aliases":["ANT-2026-K6WWQH2N","ANT-2026-ZQ6ARSMP","JLSEC-2026-622"],"status":"published","title":"Predictable WebSocket masking key and handshake nonce in HTTP.jl client","description":"### Description\n\nThe WebSocket client masking key (`ws_send_frame!`) and the `Sec-WebSocket-Key` handshake nonce (`ws_random_handshake_key`) were generated with `rand(UInt8, n)`, which draws from the task-local Xoshiro256++ PRNG. Xoshiro is not cryptographically secure: its internal state can be recovered from a short run of observed outputs, and every outbound client frame exposes 4 mask bytes on the wire. An on-path observer could therefore recover the RNG state and predict all future masking keys, defeating the RFC 6455 §5.3 anti-cache-poisoning purpose of masking.\n\n### Impact\n\nPredictable masking keys could let an on-path attacker who also supplies payload craft wire bytes that a non-conformant transparent proxy parses and caches (request/response smuggling and cache poisoning).\n\n### Patches\n\nFixed in HTTP.jl v2.4.0. A module-level CSPRNG (`const WS_CSPRNG = Random.RandomDevice()`) now generates both the 4-byte masking key and the 16-byte handshake nonce. The wire format and public API are unchanged.\n\nReported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-23T12:59:32.708Z","modified":"2026-07-21T14:00:04Z","fixes":[{"ecosystem":"Julia","package":"HTTP","fixed_in":["2.4.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"HTTP","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]}],"references":[{"url":"https://github.com/JuliaWeb/HTTP.jl/commit/5763addcbb970c8c7ca170abea56e8125526c99e","tags":["web"]},{"url":"https://github.com/JuliaWeb/HTTP.jl/pull/1316","tags":["web"]}],"sources":{"osv":[{"id":"JLSEC-2026-622","title":"Predictable WebSocket masking key and handshake nonce in HTTP.jl client","description":"### Description\n\nThe WebSocket client masking key (`ws_send_frame!`) and the `Sec-WebSocket-Key` handshake nonce (`ws_random_handshake_key`) were generated with `rand(UInt8, n)`, which draws from the task-local Xoshiro256++ PRNG. Xoshiro is not cryptographically secure: its internal state can be recovered from a short run of observed outputs, and every outbound client frame exposes 4 mask bytes on the wire. An on-path observer could therefore recover the RNG state and predict all future masking keys, defeating the RFC 6455 §5.3 anti-cache-poisoning purpose of masking.\n\n### Impact\n\nPredictable masking keys could let an on-path attacker who also supplies payload craft wire bytes that a non-conformant transparent proxy parses and caches (request/response smuggling and cache poisoning).\n\n### Patches\n\nFixed in HTTP.jl v2.4.0. A module-level CSPRNG (`const WS_CSPRNG = Random.RandomDevice()`) now generates both the 4-byte masking key and the 16-byte handshake nonce. The wire format and public API are unchanged.\n\nReported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.","status":"published","published":"2026-06-23T12:59:32.708Z","modified":"2026-07-21T14:00:04.983341081Z","updated_at":"2026-11-02T15:47:18.573531Z"}]}}