CyberRota Analysis
AI-GeneratedCentrifugo versions prior to 6.8.4 are vulnerable to a denial-of-service attack due to improper handling of unidirectional WebSocket messages with compression enabled, which can lead to excessive memory and CPU usage from unauthenticated requests. This vulnerability poses a significant risk for any deployment of Centrifugo that allows untrusted access to its WebSocket endpoints. Organizations using Centrifugo should prioritize upgrading to version 6.8.4 to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4.