Description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4.
Published: 2026-07-16
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Centrifugo allows unauthenticated users to send a large permessage-deflate compressed payload through its unidirectional WebSocket transport. When the server decompresses the data, it uses a stream that has no output cap, causing excessive memory allocation and CPU usage. The vulnerability can lead to a denial of service without requiring authentication, but does not provide code execution or data disclosure.

Affected Systems

The flaw exists in all Centrifugo releases prior to version 6.8.4. The patch is contained in release 6.8.4 and applies to any default installation using the uni_websocket transport with compression enabled.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% suggests a low but non-zero probability of exploitation. Because the attack vector is unauthenticated and network-based, a remote attacker can trigger the DoS by opening a WebSocket connection and sending a crafted payload. The vulnerability is not listed in the CISA KEV catalog, but the high impact warrants immediate mitigation.

Generated by OpenCVE AI on July 31, 2026 at 01:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Centrifugo to version 6.8.4 or newer
  • If an upgrade is not feasible, disable uni_websocket.compression so the server does not accept large compressed frames
  • Block unauthenticated access to the /connection/uni_websocket endpoint with network firewalls, load balancers, or application‑level authentication

Generated by OpenCVE AI on July 31, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Centrifugal
Centrifugal centrifugo
Vendors & Products Centrifugal
Centrifugal centrifugo

Thu, 16 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4.
Title Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport
Weaknesses CWE-409
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Centrifugal Centrifugo
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-17T13:46:40.652Z

Reserved: 2026-07-14T22:32:17.732Z

Link: CVE-2026-62963

cve-icon Vulnrichment

Updated: 2026-07-17T13:46:37.246Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T01:30:05Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)