Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/centrifugal/centrifugo

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
v2.4.0+incompatible (Mar 7, 2020): affected by 3 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
3 · 2 critical, 1 high
Releases
67 since v0.1.0 (May 23, 2015)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-71485
    Affects v0.1.0 to v2.4.0+incompatible (through the newest release)
  • CVE-2026-49998
    Affects v0.1.0 to v2.4.0+incompatible (through the newest release)
  • CVE-2026-32301
    Affects v0.1.0 to v2.4.0+incompatible (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-71485Critical 9.1

    Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

    Affected: fixed in 6.9.0; all versions.

    No fix released. The latest release, v2.4.0+incompatible, is still affected.

  • Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

    Affected: all versions; through 2.4.0.

    No fix released. The latest release, v2.4.0+incompatible, is still affected.

  • CVE-2026-32301Critical 9.3

    Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

    Affected: through 2.4.0; all versions.

    No fix released. The latest release, v2.4.0+incompatible, is still affected.