Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/centrifugal/centrifugo/v6

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
v6.10.2 (Oct 22, 2026): no advisory affects it
Newest unaffected release
v6.10.2 (Oct 22, 2026), the latest release
Advisories
3 · 2 critical, 1 high
Releases
39 since v6.0.1 (Jan 19, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-71485Critical 9.1

    Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

    Affected: fixed in 6.9.0.

    Fixed in v6.9.0 (released Jul 7, 2026, 44 days before disclosure).

    The latest release, v6.10.2, is not affected.

  • Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

    Affected: fixed in 6.8.1.

    Fixed in v6.8.1 (released May 27, 2026, 50 days before disclosure).

    The latest release, v6.10.2, is not affected.

  • CVE-2026-32301Critical 9.3

    Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

    Affected: fixed in 6.7.0.

    Fixed in v6.7.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, v6.10.2, is not affected.