Go/github.com/centrifugal/centrifugo/v6 CVE-2026-71485: critical 9.1, EPSS 0.61%

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends in github.com/centrifugal/centrifugo

Action: Upgrade github.com/centrifugal/centrifugo/v6 to 6.9.0 or later.

go get github.com/centrifugal/centrifugo/v6@v6.9.0

Affected

Fixed versions

Sources

• osv: GO-2026-6490#Go/github.com/centrifugal/centrifugo/v6
• nvd: CVE-2026-71485
• https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw
• https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0
• https://github.com/centrifugal/centrifugo/pull/1182
• https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0

CVE-2026-71485 · published 2026-09-28T16:43:40Z · modified 2026-09-28T17:00:16.955667660Z · JSON