GHSA-W67G-5RQW-F597: Cryptographically Weak PRNG for WebSocket Frame Masking in Gorilla WebSocket

Vulnerability ID: GHSA-W67G-5RQW-F597
CVSS Score: 6.9
Published: 2026-08-24

A security vulnerability in the github.com/gorilla/websocket Go library allows remote attackers to predict client-to-server frame masking keys. This occurs because the library generates 32-bit mask keys using Go's non-cryptographically secure pseudo-random number generator (math/rand). Predicting these keys enables adversaries to bypass proxy-based security protections, facilitating HTTP request smuggling and cache poisoning attacks.

TL;DR

Gorilla WebSocket used math/rand instead of crypto/rand for masking keys, allowing attackers to predict key sequences and construct payloads that bypass proxy controls to perform request smuggling or cache poisoning.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-338
• Attack Vector: Network
• CVSS Score: 6.9 (Medium)
• EPSS Score: N/A (No registered CVE)
• Impact: HTTP Request Smuggling, Cache Poisoning
• Exploit Status: Proof-of-Concept
• KEV Status: Not Listed

Affected Systems

• github.com/gorilla/websocket
• websocket: < 1.5.3 (Fixed in: 1.5.3)

Code Analysis

Commit: d67f418

Replace math/rand with crypto/rand to generate cryptographically secure frame mask keys.

Exploit Details

• GitHub Security Advisory: Advisory outlining how predictable mask keys generated by math/rand permit proxy-cache poisoning and HTTP request smuggling.

Mitigation Strategies

• Upgrade the dependency github.com/gorilla/websocket to v1.5.3 or higher.
• Enforce TLS (wss://) for all WebSocket communication to encrypt payloads before they hit transit proxies.

Remediation Steps:

1. Verify current dependency version using 'go list -m github.com/gorilla/websocket'.
2. Run 'go get github.com/gorilla/websocket@v1.5.3' to download the secure package.
3. Execute 'go mod tidy' to update the dependency tracking files.
4. Recompile and test the application to ensure compatibility.

References

• GitHub Security Advisory GHSA-W67G-5RQW-F597
• Vulnerability Patch Commit
• Gorilla WebSocket v1.5.3 Release Notes
• Advisory Source Reference

Read the full report for GHSA-W67G-5RQW-F597 on our website for more details including interactive diagrams and full exploit analysis.