CVE-2026-63405

2 advisories.

Go/github.com/anycable/anycable CVE-2026-63405: medium 5.9, EPSS 0.21%

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

Action: Upgrade github.com/anycable/anycable to 1.6.15 or later.

go get github.com/anycable/anycable@v1.6.15

Affected

introduced	fixed	last affected
0	1.6.15	-

Fixed versions

1.6.15

Sources

CVE-2026-63405 · published 2026-09-18T17:16:25Z · modified 2026-09-28T17:10:52.635822676Z · JSON

Go/github.com/anycable/anycable-go CVE-2026-63405: unknown, EPSS 0.21%

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

CVE-2026-63405 · published 2026-09-28T16:43:40Z · modified 2026-09-28T17:00:16.361269720Z · JSON