GHSA-j9wf-6r2x-hqmx

Source

https://github.com/advisories/GHSA-j9wf-6r2x-hqmx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-j9wf-6r2x-hqmx/GHSA-j9wf-6r2x-hqmx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j9wf-6r2x-hqmx

Aliases

GO-2026-4528

Published

2026-02-19T22:07:13Z

Modified

2026-02-23T19:41:19Z

Summary

Centrifugo v6.6.0 dependency vulnerabilities

Details

Summary

Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and
statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known
CVEs

Go standard library — compiled with Go 1.25.5:

CVE	Severity	CVSS	Fixed In
CVE-2025-68121	CRITICAL	10.0	Go 1.25.7, 1.24.13
CVE-2025-61726	HIGH	7.5	Go 1.25.6, 1.24.12
CVE-2025-61728	MEDIUM	6.5	Go 1.25.6, 1.24.12
CVE-2025-61730	MEDIUM	5.3	Go 1.25.6, 1.24.12

Direct dependency github.com/quic-go/webtransport-go — pinned at v0.9.0 (go.mod line 34):

CVE	Severity	CVSS	Fixed In
CVE-2026-21434	MEDIUM	5.3	webtransport-go v0.10.0
CVE-2026-21435	MEDIUM	5.3	webtransport-go v0.10.0
CVE-2026-21438	MEDIUM	5.3	webtransport-go v0.10.0

Database specific

{
    "cwe_ids":  [
        "CWE-1395"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-19T22:07:13Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/centrifugal/centrifugo/v6

Package

Name: github.com/centrifugal/centrifugo/v6; View open source insights on deps.dev
Purl: pkg:golang/github.com/centrifugal/centrifugo/v6

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.6.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-j9wf-6r2x-hqmx/GHSA-j9wf-6r2x-hqmx.json"