Which versions of Centrifugo are affected by EUVD-2026-45016?

Centrifugo real-time messaging server versions before 6.8.4 are vulnerable to remote, unauthenticated denial-of-service attacks through compression bomb payloads; no public exploit has been…. A patch is available.

How to fix or mitigate EUVD-2026-45016?

Within 24 hours, identify all Centrifugo deployments and verify which versions are in use, particularly any running before version 6.8.4. Within 7 days, implement compensating controls including decompressed message size limits enforced at the infrastructure layer (independent of Centrifugo's compressed message_size_limit), rate limiting on WebSocket connections to throttle potential attack traffic, and if operationally feasible, network-level restrictions limiting WebSocket access to known clients. Within 30 days, establish a monitoring process for Centrifugo security advisories to detect patch availability, and coordinate with your platform and development teams to schedule a pre-tested upgrade to version 6.8.4 or later once verified.

Centrifugo EUVD-2026-45016

Q: What is the CVSS score of EUVD-2026-45016?

EUVD-2026-45016 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-62963 HIGH

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-07-16 GitHub_M

Information Disclosure Centrifugo Centrifugal

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N) with a simple crafted frame (AC:L); impact is pure availability exhaustion (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 16, 2026 - 22:19 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 20:18 vuln.today

Analysis Generated

Jul 16, 2026 - 20:18 vuln.today

CVE Published

Jul 16, 2026 - 19:34 cve.org

HIGH 8.7

DescriptionCVE.org

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but ReadMessage used io.ReadAll after decompression without an output cap, allowing unauthenticated requests to /connection/uni_websocket to trigger large memory and CPU consumption. This issue is fixed in version 6.8.4.

AnalysisAI

Uncontrolled memory and CPU exhaustion in Centrifugo real-time messaging server before 6.8.4 lets unauthenticated attackers send a small compressed WebSocket frame to the unidirectional transport that inflates into a massive decompressed payload. The message_size_limit was only checked against compressed wire bytes, while decompressed output was read via io.ReadAll with no cap, enabling a classic decompression bomb denial of service. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw lives in Centrifugo's unidirectional WebSocket transport (/connection/uni_websocket) which supports permessage-deflate compression. In internal/websocket/conn.go the advanceFrame routine enforced uni_websocket.message_size_limit against the compressed wire-frame length, but ReadMessage subsequently called io.ReadAll after DEFLATE decompression without bounding the output size. This is CWE-409 (Improper Handling of Highly Compressed Data / decompression bomb): because DEFLATE can achieve amplification ratios well above 1000:1, a tiny compliant compressed frame decompresses into hundreds of megabytes or more, consuming heap and CPU. The upstream logic actually resides in the github.com/centrifugal/centrifuge library, which Centrifugo bumps in the fix; the patch introduces a DecompressedMessageSizeLimit that, when unset, defaults to message_size_limit multiplied by a factor of 10, capping post-decompression expansion for both the bidirectional and unidirectional WebSocket transports. Affected component per CPE is cpe:2.3:a:centrifugal:centrifugo.

RemediationAI

Vendor-released patch: upgrade to Centrifugo 6.8.4 (https://github.com/centrifugal/centrifugo/releases/tag/v6.8.4), which adds a decompressed_message_size_limit cap for the WebSocket and uni_websocket transports; per the advisory GHSA-q6mr-3g59-5m8x and PR https://github.com/centrifugal/centrifugo/pull/1162 (commit 46d40e4ac3a5446c9745f8b219197166ae12a6e5) the limit defaults to message_size_limit times 10 when left at zero. If you cannot upgrade immediately, disable uni_websocket.compression, which fully removes the decompression path and thus the vulnerability at the cost of higher bandwidth for large messages; alternatively lower uni_websocket.message_size_limit to shrink the maximum amplification input, or restrict/front the /connection/uni_websocket endpoint behind an authenticating reverse proxy or WAF and apply per-connection rate and resource limits, accepting that these controls only reduce rather than eliminate the amplification risk. After upgrading, explicitly set decompressed_message_size_limit to a value appropriate for your legitimate message sizes.