11571 matches found
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Overview github.com/gorilla/websocket is a Go implementation of the WebSocket protocol. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the newMaskKey function in conn.go. An attacker can predict or recover WebSocket frame...
External Control of Assumed-Immutable Web Parameter
Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...
org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...
org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...
org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350820...
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...
GHSA-V7H8-XHH6-GFJ4 Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...
GHSA-M5R8-W65Q-8WJF Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...
org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...
org.apache.camel.karaf:camel-atmosphere-websocket (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.0.0, <=4.14.8) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.0.0, <=4.14.8)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.8 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...
org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...
org.apache.camel.karaf:camel-atmosphere-websocket (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.15.0, <=4.18.3) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.15.0, <=4.18.3)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.3 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...
org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: OSV:GHSA-M5R8-W65Q-8WJF...
org.apache.camel.springboot:camel-atmosphere-websocket-starter (>=4.19.0, <=4.21.0) potentially affected by CVE-2026-71300 via org.apache.camel:camel-atmosphere-websocket (>=4.19.0, <=4.21.0)
org.apache.camel:camel-atmosphere-websocket MAVEN version =4.19.0, =4.19.0, =4.21.0 Source cves: CVE-2026-71300 Source advisory: GHSA-M5R8-W65Q-8WJF...
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...
CVE-2026-78329
Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...
CVE-2026-71300
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...
daphne: daphne: Denial of Service via excessive WebSocket message size
A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service DoS for the affected system...
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...