Repository navigation
Documented: math/rand → crypto/rand mask key fix (CWE-338, never CVE'd) #1024
Description
Not a zero-day — already fixed in v1.5.3. Documenting a silent security fix from commit d67f418.\n\n- Finding: WebSocket mask keys generated with math/rand instead of crypto/rand (CWE-338)\n- Fix: v1.5.3 (2024-06-14)\n- Advisory: https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597\n- Tool: bounty-hunter v6.0
Activity
abscondment commentedon Aug 25, 2026
@canolgun this does not appear to be accurate.
https://github.com/gorilla/websocket/commits/v1.5.3 does not contain the code from d67f418
See, for example, the continued use of
math/rand: https://github.com/gorilla/websocket/blob/v1.5.3/conn.go#L13v1.5.3 was tagged/published on 2024-06-14, 2+ weeks before that commit was made.
Am I missing something?