GO-2026-6278
MediumAdvisory
Published 24 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 668
- of 17,787 indexed, latest versions
- Container images
- 668
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
Carried by container images the latest versions of 668 of 17,787 indexed charts deploy, on 668 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v1.4.0, v1.4.1, v1.4.2, v1.5.0+2 more | 1.5.3 | 668 |
- OSV records
- GHSA-w67g-5rqw-f597GO-2026-6278
Charts affected
668 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| longhornwenerme | 1.2.3 | 1 of 2See more | 15,230 |
| miniowenerme | 8.0.10 | 1 of 1See more | 6,915 |
| minio-standalonewenerme | 1.0.2 | 1 of 1See more | 6,138 |
| temporalwenerme | 0.15.1 | 3 of 13See more | 22,665 |
| traefikwenerme | 9.1.1 | 1 of 1See more | 3,369 |
| wexa-studiowexa-studio | 1.2.0 | 4 of 15See more | 14,983 |
| opentelemetry-collectorwikimedia | 0.62.7 | 1 of 1See more | 2,022 |
| wireguardwireguard-bananas | 1.5.0 | 1 of 1See more | 2,745 |
| postgres-operatorwiremindVerified publisher | 1.14.0-wiremind0 | 1 of 1See more | 1,286 |
| commentopluspluswyrihaximusnetVerified publisher | 0.4.0 | 1 of 1See more | 1,960 |
| oauth2xdVerified publisher | 1.0.0 | 1 of 1See more | 2,007 |
| owlxdVerified publisher | 0.5.1 | 2 of 2See more | 3,880 |
| passportxdVerified publisher | 0.2.16 | 2 of 2See more | 3,974 |
| tabbyxdVerified publisher | 1.0.6 | 1 of 2See more | 7,673 |
| treexdVerified publisher | 0.1.10 | 1 of 1See more | 1,997 |
| zooxdVerified publisher | 0.4.0 | 1 of 1See more | 1,955 |
| xkopsxkops | 0.1.0 | 1 of 5See more | 13,677 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 9,381 |
Container images carrying it
668 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| bitnamilegacy/ | f5fc0d561d9e | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| bitnamilegacy/ | 0b60b6565ab2 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| bitnamilegacy/ | 0f7c8ac484ac | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| bitnamilegacy/ | 5bb0aa825d16 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| bitnamilegacy/ | 08b1b7cb6a5b | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| bolkedebruin/ | c0dc0589373a | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| burganbank/ | 9259c34e4037 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| caroga/ | f3233882b3bd | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| casbin/ | 770ad9ec3190 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| chainflag/ | ac642796bcb6 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| chaosnative/ | e7bcff4a20c0 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| chirpstack/ | e0b23dfd24d6 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| chirpstack/ | fb7667fe037f | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| chirpstack/ | ce3f2cdca8a9 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| chirpstack/ | c0bbbb7a3f1e | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cloudflare/ | 14d9c6b01b29 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cloudflare/ | 5d5f70a59d5e | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cloudflare/ | c18744ae1767 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cloudflare/ | eb5c9324efe3 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| consensys/ | f146a51a1ba3 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| containous/ | 587162516502 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cortezaproject/ | 0bcdcbcd3c63 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cortezaproject/ | 8eb7a26605c9 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| cortezaproject/ | cb9f200de5d2 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| daprio/ | 4be696707bd1 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| daprio/ | 7ba5d51e5b97 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| darkobas/ | 62e6464491ba | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| darkobas/ | a0349a0eedf0 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| datamate/ | 2dd66b722464 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| datawire/ | 95ec30b3c732 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| datawire/ | 1f67a1292d2a | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ddvk/ | 2f5c45cbf0c5 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| defactops/ | 825cdf9ba706 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| devspacecloud/ | 49c397413f7b | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| dnsforge/ | 4d9a685c8c28 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| dserio83/ | 6b3d9115fee2 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| elastic/ | c7a1c63257d0 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| emqx/ | a8431baa7950 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| emqx/ | fa876f71e5d6 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| emqxecp/ | 4c31d9bec846 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| epamedp/ | 93417e18bb1a | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | 1f36ca5922a5 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | 32b878e4144a | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | 37575ec10fbc | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | 6d6d12a40465 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | 886ec69b35b0 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | b8ab3451a117 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | cce21b423165 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereum/ | d99fbb9585c7 | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |
| ethereumoptimism/ | 5577036dc36d | github.com/ github.com/ | 1.5.3 1.5.3 | 1 |