Read the docs
TI-2020-16885 Aliases CVE-2020-27813GHSA-3xh2-74w9-5vxm

Integer overflow in golang-github-gorilla-websocket

Priority LOW 37CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 5 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

Why it matters now

EPSS 0.02188 82nd percentileScored 2026-11-07
Fix Partial github.com/gorilla/websocket (Go): 1.4.1Red Hat: 8 advisoriesRed Hat: 5 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—golang-github-gorilla-websocketgithub.com/gorilla/websocket v1.4.1—No fix listedCNA
—github.com/gorilla/websocket (Go)before 1.4.11.4.1Patch availableGHSA-3xh2-74w9-5vxm
  • golang-github-gorilla-websocket Vendor— Affected github.com/gorilla/websocket v1.4.1 Fixed in — No fix listed CNA
  • github.com/gorilla/websocket (Go) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-3xh2-74w9-5vxm

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gorillatoolkit:websocket:*:*:*:*:*:*:*:*before 1.4.1VulnerableGorillatoolkit
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:gorillatoolkit:websocket:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Gorillatoolkit
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-3xh2-74w9-5vxm github.com/gorilla/websocket (Go) Fixed in 1.4.1 Advisory →

Red Hat 8 advisories

  • RHSA-2021:2920 Released 2021-07-28 · Red Hat rating Moderate
    OpenShift Virtualization 4.8.0 Images
    • CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
  • RHSA-2021:1561 Released 2021-05-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-hyperkube
  • RHSA-2021:0833 Released 2021-03-25 · Red Hat rating Moderate
    OpenShift Container Platform 3.11.404 security and bug fix update
    • Red Hat OpenShift Container Platform 3.11 atomic-openshift-cluster-autoscaler-3.11.404-1.git.0.2c258fe.el7
Show 5 more Red Hat advisories
  • RHSA-2021:0799 Released 2021-03-10 · Red Hat rating Moderate
    OpenShift Virtualization 2.6.0 security and bug fix update
    • CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
  • RHSA-2021:0100 Released 2021-02-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7 file-integrity-operator image security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/file-integrity-rhel8-operator
  • RHSA-2020:5364 Released 2021-02-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7 low-latency extras security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 openshift4/cnf-tests-rhel8, openshift4/dpdk-base-rhel8, openshift4/performance-addon-operator-bundle-registry-container-rhel8 +2
  • RHSA-2021:0190 Released 2021-01-19 · Red Hat rating Moderate
    OpenShift Container Platform 4.6 compliance-operator security and bug fix update
    • Red Hat OpenShift Container Platform 4.6 openshift4/compliance-rhel8-operator, openshift4/compliance-rhel8-operator-metadata
  • RHSA-2021:0187 Released 2021-01-19 · Red Hat rating Moderate
    OpenShift Virtualization 2.5.3 security and bug fix update
    • CNV 2.5 for RHEL 8 container-native-virtualization/vm-import-controller-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform Assisted Installer 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 2AffectedNo fix yet
CNV 2.5 for RHEL 8Fixed RHSA-2021:0187
CNV 4.8 for RHEL 8Fixed RHSA-2021:2920
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:0833
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:0190
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2020:5364, RHSA-2020:5633, RHSA-2021:0100, RHSA-2021:1561
Not affected: 9 products
  • CNV 2.5 for RHEL 8
  • OpenShift Serverless
  • OpenShift Service Mesh 1
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27813
  2. 2026-10-03 Alias added: GHSA-3xh2-74w9-5vxm

References

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences