N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j9wf-6r2x-hqmx

GHSA-j9wf-6r2x-hqmx: Centrifugo v6.6.0 dependency vulnerabilities

Summary

Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and
statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known
CVEs

Go standard library — compiled with Go 1.25.5:

| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2025-68121 | CRITICAL | 10.0 | Go 1.25.7, 1.24.13 | | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |

Direct dependency github.com/quic-go/webtransport-go — pinned at v0.9.0 (go.mod line 34):

| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j9wf-6r2x-hqmx

GHSA-j9wf-6r2x-hqmx:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/centrifugal/centrifugo/v6	go	< 6.6.1	6.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is due to Centrifugo being compiled with a vulnerable version of Go (1.25.5) and linking a vulnerable version of github.com/quic-go/webtransport-go (v0.9.0). The fix involves updating these dependencies to Go 1.25.7 and webtransport-go v0.10.0 respectively. The commit e35678ffa5796b92a774b9c7f0b9b85e6ead51ef implements this fix. Analysis of this commit shows changes in internal/app/mux.go within the runHTTPServers function. This function is responsible for setting up and running the HTTP servers, including the WebTransport server which relies on the vulnerable webtransport-go library. The changes in the patch within this function are required to adapt to the API of the upgraded, non-vulnerable library. Therefore, runHTTPServers is the function that directly initializes and uses the vulnerable component, making it the primary function that would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

runHTTPServers

internal/app/mux.go

This function is responsible for configuring and running the HTTP servers, including the WebTransport server. It initializes `webtransport.Server` from the vulnerable `github.com/quic-go/webtransport-go` library (version < 0.10.0). The patch that fixes the vulnerability by updating this library and the Go version includes changes in this function to adapt to the updated library's API. Therefore, this function is the entry point within the Centrifugo codebase that sets up the vulnerable component.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.