Quick answers
- Is CVE-2026-62963 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62963 being exploited in the wild.
- How severe is CVE-2026-62963?
- Informational severity, with a CVSS score of 8.7, published 16 July 2026.
- Which products and versions are affected?
- Centrifugal Centrifugo < 6.8.4.
- Is there a fix for CVE-2026-62963?
- A patch was published on 2026-06-28: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62963 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-62963?
- Check whether you run Centrifugal Centrifugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A resource exhaustion vulnerability exists in Centrifugo's unidirectional WebSocket transport when 'uni_websocket.compression' is enabled. While the server enforced 'uni_websocket.message_size_limit' against the compressed wire-frame length, the 'ReadMessage' function used 'io.ReadAll' after decompression without an output cap. This allows an unauthenticated remote attacker to send a 'decompression bomb'—a small compressed payload that expands into a massive amount of data—triggering excessive memory and CPU consumption. The vulnerability is rooted in 'internal/websocket/conn.go' and 'internal/websocket/compression.go'. Version 6.8.4 fixes this by introducing 'decompressed_message_size_limit' to bound the size of messages after decompression.
Affected products
- Centrifugal Centrifugo < 6.8.4
Timeline
- 2026-06-28: patched: Fix committed to master branch
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD