Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/centrifugal/centrifugo/v4

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
v4.1.5 (Jun 24, 2023): affected by 3 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
3 · 2 critical, 1 high
Releases
13 since v4.0.0 (Jul 20, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-71485
    Affects v4.0.0-beta.1 to v4.1.5 (through the newest release)
  • CVE-2026-49998
    Affects v4.0.0-beta.1 to v4.1.5 (through the newest release)
  • CVE-2026-32301
    Affects v4.0.0-beta.1 to v4.1.5 (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-71485Critical 9.1

    Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

    Affected: all versions.

    No fix released. The latest release, v4.1.5, is still affected.

  • Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

    Affected: all versions; through 4.1.5.

    No fix released. The latest release, v4.1.5, is still affected.

  • CVE-2026-32301Critical 9.3

    Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

    Affected: through 4.1.5; all versions.

    No fix released. The latest release, v4.1.5, is still affected.