modules:
  - module: github.com/gorilla/websocket
    versions:
      - fixed: 1.4.1
    vulnerable_at: 1.4.0
    packages:
      - package: github.com/gorilla/websocket
        symbols:
          - Conn.advanceFrame
          - messageReader.Read
        derived_symbols:
          - Conn.Close
          - Conn.NextReader
          - Conn.NextWriter
          - Conn.ReadJSON
          - Conn.ReadMessage
          - Conn.WriteControl
          - Conn.WriteJSON
          - Conn.WriteMessage
          - Conn.WritePreparedMessage
          - Dialer.Dial
          - Dialer.DialContext
          - NewClient
          - NewPreparedMessage
          - ReadJSON
          - Subprotocols
          - Upgrade
          - Upgrader.Upgrade
          - WriteJSON
          - flateReadWrapper.Read
          - flateWriteWrapper.Close
          - flateWriteWrapper.Write
          - httpProxyDialer.Dial
          - messageWriter.Close
          - messageWriter.ReadFrom
          - messageWriter.Write
          - messageWriter.WriteString
          - netDialerFunc.Dial
          - proxy_direct.Dial
          - proxy_envOnce.Get
          - proxy_socks5.Dial
          - truncWriter.Write
description: |
    An attacker can craft malicious WebSocket frames that cause an integer
    overflow in a variable which tracks the number of bytes remaining. This
    may cause the server or client to get stuck attempting to read frames
    in a loop, which can be used as a denial of service vector.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2020-27813
ghsas:
  - GHSA-3xh2-74w9-5vxm
credit: Max Justicz
references:
  - fix: https://github.com/gorilla/websocket/pull/537
  - fix: https://github.com/gorilla/websocket/commit/5b740c29263eb386f33f265561c8262522f19d37