VDB
GO-2026-6278
GO-2026-6278
PUBLISHED
Record from OSV · Published August 25, 2026
github.com/gorilla/websocket is fixed in 1.5.3 (Go Modules)
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/gorilla/websocket | Go Modules | 1.5.3 |
| virt-controller-1.6 | Chainguard | 1.6.6-r7 |
| opentelemetry-collector-contrib | Chainguard | 0.139.0-r0 |
| aws-node-termination-handler | Chainguard | 1.25.6-r18 |
| cilium-1.17 | Chainguard | 1.17.18-r8 |
| cluster-api-fips-1.8 | Chainguard | 1.8.12-r25 |
| infinispan-operator | Wolfi | 2.5.14-r4 |
| kubevela | Wolfi | 1.11.0-r8 |
| rancher-telemetry | Wolfi | 0.6.2-r28 |
| eks-distro-fips-1.31 | Chainguard | 1.31.47-r4 |
| virt-launcher-1.6 | Chainguard | 1.6.6-r7 |
| verticadb-operator | Chainguard | 25.4.0.0-r26 |
61 more packages have a fixed version. See every fix in Lookup.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | virt-controller-1.6 | 0 |
| chainguard | opentelemetry-collector-contrib | 0 |
| chainguard | cilium-1.17 | 0 |
| wolfi | infinispan-operator | 0 |
| wolfi | kubevela | 0 |
| chainguard | eks-distro-fips-1.31 | 0 |
| chainguard | virt-launcher-1.6 | 0 |
| chainguard | virt-api-fips-1.6 | 0 |
| chainguard | longhorn-engine-1.8 | 0 |
| chainguard | cluster-api-1.8 | 0 |
| wolfi | verticadb-operator | 0 |
| chainguard | cloudflared-fips | 0 |
| chainguard | gpu-operator-fips-24.9 | 0 |
| github.com | gorilla/websocket | 0 |
| chainguard | opentelemetry-collector-contrib-fips | 0 |
| chainguard | etcd-3.6 | 0 |
| chainguard | loki-2.9 | 0 |
| chainguard | rancher-telemetry | 0 |
| chainguard | prometheus-fips-3.5 | 0 |
| chainguard | guac | 0 |
…and 64 more
Timeline
- Aug 25, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2026-6278
vulnetix vdb fixes GO-2026-6278Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6278/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart