Skip to content
Fencer Intel
high 7.5

CVE-2020-27813 json

Integer overflow in github.com/gorilla/websocket

published 5y ago modified 4mo ago also GHSA-3xh2-74w9-5vxm , GHSA-jf24-p9p9-4rjh , GO-2020-0019 , EUVD-2021-0926

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

Patch / fix

  • go github.com/gorilla/websocket 1.4.1
  • gorillatoolkit websocket 1.4.1
  • golang-websocket Ubuntu Pro 16.04 LTS 0.0~git20150811.0.b6ab76f-1ubuntu0.1~esm1
  • golang-websocket Ubuntu Pro 18.04 LTS 1.2.0-1ubuntu2+esm1

ubuntu advisories UBUNTU-CVE-2020-27813

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • atomic-openshift-cluster-autoscaler openshift 3.11 3.11.404-1.git.0.2c258fe.el7

red hat advisories RHSA-2021:0833

Is CVE-2020-27813 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-27813 updated cvss 7.5

golang-github-gorilla-websocket: integer overflow leads to denial of service

  • Red Hat OpenShift Service Mesh 1 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/apicast-rhel7-operator Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-etcd
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8, rhai-tech-preview/assisted-installer-reporter-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 2 virt-handler, virt-launcher, virt-operator, virt-controller, vm-import-operator, vm-import-controller, +2 more
    affected: no fix available
  • Red Hat CNV 2.5 for RHEL 8 container-native-virtualization/vm-import-controller-rhel8 v2.5.3-4
    fixed: vendor fix RHSA-2021:0187
  • Red Hat CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8 v4.8.0-18
    fixed: vendor fix RHSA-2021:2920
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift-cluster-autoscaler 3.11.404-1.git.0.2c258fe.el7
    fixed: vendor fix RHSA-2021:0833
  • Red Hat OpenShift Container Platform 4.6 openshift4/compliance-rhel8-operator v4.6.0-97, openshift4/compliance-rhel8-operator-metadata v4.6.0.97-1
    fixed: vendor fix RHSA-2021:0190
show 2 more
  • Red Hat OpenShift Container Platform 4.7 openshift4/dpdk-base-rhel8 v4.7.0-6, openshift4/cnf-tests-rhel8 v4.7.0-34, openshift4/ose-console v4.7.0-202102130115.p0, openshift4/ose-hyperkube v4.7.0-202105160013.p0, openshift4/file-integrity-rhel8-operator v4.7.0-9, openshift4/performance-addon-rhel8-operator v4.7.0-30, +2 more
    fixed: vendor fix RHSA-2020:5364
  • Red Hat CNV 2.5 for RHEL 8 container-native-virtualization/kubevirt-cpu-node-labeller v2.5.3-3, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.5.3-2, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.5.3-1 Red Hat OpenShift Serverless knative-serving knative-serving Red Hat OpenShift Service Mesh 1 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-galley, servicemesh-citadel, servicemesh-istioctl, +4 more Red Hat Advanced Cluster Management for Kubernetes 2 websocket Red Hat OpenShift Container Platform 3.11 prometheus 3.11.404-1.git.5026.5f1d705.el7, atomic-openshift 3.11.404-1.git.0.dd58619.el7, openshift-ansible 3.11.404-1.git.0.d161108.el7, openshift-kuryr 3.11.404-1.git.1494.91fb403.el7, atomic-openshift-pod 3.11.404-1.git.0.dd58619.el7, atomic-openshift-node 3.11.404-1.git.0.dd58619.el7, +33 more Red Hat OpenShift Container Platform 4 openshift4/ose-grafana, openshift4/ose-thanos-rhel9, openshift-hive-operator-container
    +3 more products
    Red Hat OpenShift Container Platform 4.6 openshift4/compliance-content-rhel8 v4.6.0-20, openshift4/compliance-openscap-rhel8 v4.6.0.scap1.3.4-7 Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202102130115.p0, openshift4/ose-pod v4.7.0-202102130115.p0, openshift4/ose-etcd v4.7.0-202102130115.p0, openshift4/ose-tests v4.7.0-202102181036.p0, openshift4/ose-tests v4.7.0-202105141715.p0, openshift4/ose-coredns v4.7.0-202102130115.p0, +146 more Red Hat Quay 3 quay-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/gorilla/websocket
<1.4.1
1.4.1

Affected products

  • n/a golang-github-gorilla-websocket

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.