Go/github.com/centrifugal/centrifugo CVE-2026-71485: critical 9.1, EPSS 0.61%

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Action: Upgrade github.com/centrifugal/centrifugo to 6.9.0 or later.

go get github.com/centrifugal/centrifugo@v6.9.0

Affected

Fixed versions

Sources

• osv: GHSA-9468-v6mj-fppw
• https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw
• https://nvd.nist.gov/vuln/detail/CVE-2026-71485
• https://github.com/centrifugal/centrifugo/pull/1182
• https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0
• https://github.com/centrifugal/centrifugo
• https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0

CVE-2026-71485 · published 2026-09-02T23:41:37Z · modified 2026-09-28T17:11:21.029419736Z · JSON