Impact

⚠️ A potential denial-of-service (DoS) vector that can cause an integer overflow in the presence of malicious WebSocket frames was reported in gorilla/websocket versions <= v1.4.0. This could allow an attacker to consume excessive amounts of memory on the server by bypassing read limits, and potentially cause the server to go out-of-memory (OOM).

Fix

👷 A fix (see 5b740c2) adds checks against the remaining bytes on a connection, as well as a test to prevent regression.

❗ We recommend users upgrade the version of gorilla/websocket in-use to >= v1.4.1 and ensure any dependency manifests (go.mod, Gopkg.toml, etc.) pin to the fixed version.

Credit

Credit to Max Justicz (https://justi.cz/) for discovering and reporting this, as well as providing a robust PoC and review.