Skip to content
Fencer Intel
medium —

GHSA-j9wf-6r2x-hqmx json

Centrifugo v6.6.0 dependency vulnerabilities

published 8mo ago modified 8mo ago also GO-2026-4528

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary

Centrifugo v6.6.0 binary is compiled with **Go 1.25.5** and statically links `github.com/quic-go/webtransport-go v0.9.0`, having **7 known CVEs**

**Go standard library — compiled with Go 1.25.5:**

| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2025-68121 | **CRITICAL** | 10.0 | Go 1.25.7, 1.24.13 | | CVE-2025-61726 | HIGH | 7.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61728 | MEDIUM | 6.5 | Go 1.25.6, 1.24.12 | | CVE-2025-61730 | MEDIUM | 5.3 | Go 1.25.6, 1.24.12 |

**Direct dependency `github.com/quic-go/webtransport-go` — pinned at v0.9.0 (`go.mod` line 34):**

| CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2026-21434 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21435 | MEDIUM | 5.3 | webtransport-go v0.10.0 | | CVE-2026-21438 | MEDIUM | 5.3 | webtransport-go v0.10.0 |

Patch / fix

  • go github.com/centrifugal/centrifugo/v6 6.6.1

Is GHSA-j9wf-6r2x-hqmx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/centrifugal/centrifugo/v6
<6.6.1
6.6.1
go github.com/centrifugal/centrifugo
all versions
 no fix listed
go github.com/centrifugal/centrifugo/v3
all versions
 no fix listed
go github.com/centrifugal/centrifugo/v4
all versions
 no fix listed
go github.com/centrifugal/centrifugo/v5
all versions
 no fix listed

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.