{"id":"GHSA-j9wf-6r2x-hqmx","aliases":["GO-2026-4528"],"status":"published","title":"Centrifugo v6.6.0 dependency vulnerabilities","description":"### Summary                                                                                                                                                                                              \n                                                                                                                                                                                                           \n  Centrifugo v6.6.0 binary is compiled with **Go 1.25.5** and                                                                                                                       \n  statically links `github.com/quic-go/webtransport-go v0.9.0`, having **7 known                                                                                                                      \n  CVEs**\n\n  **Go standard library — compiled with Go 1.25.5:**\n\n  | CVE | Severity | CVSS | Fixed In |\n  |-----|----------|------|----------|\n  | CVE-2025-68121 | **CRITICAL** | 10.0 | Go 1.25.7, 1.24.13 |\n  | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 |\n  | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 |\n  | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |\n\n  **Direct dependency `github.com/quic-go/webtransport-go` — pinned at v0.9.0\n  (`go.mod` line 34):**\n\n  | CVE | Severity | CVSS | Fixed In |\n  |-----|----------|------|----------|\n  | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 |\n  | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 |\n  | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395"],"published":"2026-02-19T22:07:13Z","modified":"2026-02-23T19:41:19Z","fixes":[{"ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v6","fixed_in":["6.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/centrifugal/centrifugo","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/centrifugal/centrifugo/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.6.1"}]}]}],"references":[{"url":"https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j9wf-6r2x-hqmx","tags":["web","advisory"]},{"url":"https://github.com/centrifugal/centrifugo/releases/tag/v6.6.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j9wf-6r2x-hqmx"},{"url":"https://github.com/centrifugal/centrifugo","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-j9wf-6r2x-hqmx","title":"Centrifugo v6.6.0 dependency vulnerabilities","description":"### Summary                                                                                                                                                                                              \n                                                                                                                                                                                                           \n  Centrifugo v6.6.0 binary is compiled with **Go 1.25.5** and                                                                                                                       \n  statically links `github.com/quic-go/webtransport-go v0.9.0`, having **7 known                                                                                                                      \n  CVEs**\n\n  **Go standard library — compiled with Go 1.25.5:**\n\n  | CVE | Severity | CVSS | Fixed In |\n  |-----|----------|------|----------|\n  | CVE-2025-68121 | **CRITICAL** | 10.0 | Go 1.25.7, 1.24.13 |\n  | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 |\n  | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 |\n  | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |\n\n  **Direct dependency `github.com/quic-go/webtransport-go` — pinned at v0.9.0\n  (`go.mod` line 34):**\n\n  | CVE | Severity | CVSS | Fixed In |\n  |-----|----------|------|----------|\n  | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 |\n  | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 |\n  | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |","status":"published","published":"2026-02-19T22:07:13Z","modified":"2026-02-19T22:07:14Z","cwes":["CWE-1395"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"osv":[{"id":"GHSA-j9wf-6r2x-hqmx","title":"Centrifugo v6.6.0 dependency vulnerabilities","description":"### Summary                                                                                                                                                                                              \n                                                                                                                                                                                                           \n  Centrifugo v6.6.0 binary is compiled with **Go 1.25.5** and                                                                                                                       \n  statically links `github.com/quic-go/webtransport-go v0.9.0`, having **7 known                                                                                                                      \n  CVEs**\n\n  **Go standard library — compiled with Go 1.25.5:**\n\n  | CVE | Severity | CVSS | Fixed In |\n  |-----|----------|------|----------|\n  | CVE-2025-68121 | **CRITICAL** | 10.0 | Go 1.25.7, 1.24.13 |\n  | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 |\n  | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 |\n  | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |\n\n  **Direct dependency `github.com/quic-go/webtransport-go` — pinned at v0.9.0\n  (`go.mod` line 34):**\n\n  | CVE | Severity | CVSS | Fixed In |\n  |-----|----------|------|----------|\n  | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 |\n  | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 |\n  | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |","status":"published","published":"2026-02-19T22:07:13Z","modified":"2026-02-23T19:41:19.423703Z","cwes":["CWE-1395"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"GO-2026-4528","title":"Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo","description":"Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo","status":"published","published":"2026-02-23T18:23:15Z","modified":"2026-02-23T19:41:19.423703Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}