{"id":"GO-2026-6490","revision":"19449b038fe14c769a0334aae9a88c56","records":[{"revision":"19449b038fe14c769a0334aae9a88c56","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6490","aliases":["CVE-2026-71485","GHSA-9468-v6mj-fppw"],"title":"Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends in github.com/centrifugal/centrifugo","description":"Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends in github.com/centrifugal/centrifugo","state":0,"publishedAt":"2026-09-28T16:43:40+00:00","modifiedAt":"2026-09-28T17:00:16.9556677+00:00","affected":[{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.9.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw","https://nvd.nist.gov/vuln/detail/CVE-2026-71485","https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0","https://github.com/centrifugal/centrifugo/pull/1182","https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6490","license":"OSV · upstream source license applies","key":"osv:GO-2026-6490","identifiers":["GO-2026-6490","CVE-2026-71485","GHSA-9468-v6mj-fppw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}