Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/centrifugal/centrifugo/v3

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
v3.2.3 (Jun 30, 2022): affected by 3 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
3 · 2 critical, 1 high
Releases
14 since v3.0.0 (Sep 1, 2021)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-71485
    Affects v3.0.0-beta.1 to v3.2.3 (through the newest release)
  • CVE-2026-49998
    Affects v3.0.0-beta.1 to v3.2.3 (through the newest release)
  • CVE-2026-32301
    Affects v3.0.0-beta.1 to v3.2.3 (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-71485Critical 9.1

    Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

    Affected: all versions.

    No fix released. The latest release, v3.2.3, is still affected.

  • Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

    Affected: all versions; through 3.2.3.

    No fix released. The latest release, v3.2.3, is still affected.

  • CVE-2026-32301Critical 9.3

    Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

    Affected: through 3.2.3; all versions.

    No fix released. The latest release, v3.2.3, is still affected.