Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Affecting github.com/gorilla/websocket package, versions <1.5.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMGORILLAWEBSOCKET-19256866
- published25 Aug 2026
- disclosed24 Aug 2026
- creditUnknown
Introduced: 24 Aug 2026
New CVE NOT AVAILABLE CWE-338 (opens in a new tab)How to fix?
Upgrade github.com/gorilla/websocket to version 1.5.3 or higher.
Overview
github.com/gorilla/websocket is a Go implementation of the WebSocket protocol.
Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) via the newMaskKey function in conn.go. An attacker can predict or recover WebSocket frame mask keys by causing the client side to generate masking values with math/rand, then use that predictability to inject content into WebSocket connections. The flaw affects WebSocket masking key generation for client frames, where unpredictable 32-bit keys are required. When the mask key can be guessed, an attacker can tamper with masked frame contents and disrupt or alter the data a user’s WebSocket connection sends or receives.