CVE-2026-62963
Received Received - Intake

Memory Exhaustion in Centrifugo WebSocket Transport

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-17
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-62963
EUVD
EUVD-2026-45016

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
centrifugal centrifugo to 6.8.4 (inc)
centrifugal centrifugo to 6.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62963 is a decompression bomb denial-of-service vulnerability in Centrifugo's unidirectional WebSocket transport. When WebSocket compression is enabled, a small compressed message can expand into a much larger payload during decompression. The server only enforced size limits on compressed frames but not decompressed data, allowing attackers to send highly compressible data that consumes excessive memory and CPU.

Detection Guidance

Monitor Centrifugo logs for WebSocket connection errors or unusual memory/CPU spikes. Check for connections to /connection/uni_websocket with high traffic volume. Use system monitoring tools like top, htop, or netstat to detect abnormal resource consumption during WebSocket operations.

Impact Analysis

This vulnerability can cause denial-of-service by consuming excessive server memory and CPU. Attackers can trigger it without authentication via crafted WebSocket messages, potentially crashing the server or degrading performance for legitimate users.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires ensuring availability of processing systems, while HIPAA mandates safeguards against service disruptions. Exploiting this flaw could lead to unauthorized resource exhaustion, potentially violating availability requirements.

Mitigation Strategies

Upgrade Centrifugo to version 6.8.4 or later. Disable WebSocket compression if not required. Set decompressed_message_size_limit in configuration to a reasonable value based on expected message sizes. Monitor server performance after changes to ensure stability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62963. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart