Centrifugal vulnerabilities
We track 4 vulnerabilities in Centrifugal products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Centrifugal vulnerabilities
- 9.1 Critical severity
centrifugo: Authentication Bypass by Spoofing
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeaders
- 8.7 High severity
centrifugo: Improper Handling of Highly Compressed Data (Data Amplification)
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/we
- 8.2 High severity
centrifugo: Improper Verification of Cryptographic Signature
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup w
- 9.3 Critical severity
centrifugo: Server-Side Request Forgery
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated att