CVE-2026-62963 Details

A denial-of-service vulnerability has been identified in Centrifugo versions prior to 6.8.4. The issue arises in the unidirectional WebSocket transport when compression is enabled. The server improperly handles compressed data, allowing unauthenticated requests to the WebSocket connection endpoint to cause significant memory and CPU strain. This vulnerability exploits the WebSocket 'permessage-deflate' compression, which can inflate a small compressed frame into a large amount of uncompressed data, effectively creating a 'decompression bomb' attack. The problem is rooted in the WebSocket connection's read message handling, where the decompressed data is not subject to any size limit, contrary to the compressed data which is capped.

Users can upgrade to Centrifugo version 6.8.4 or later, where this vulnerability has been fixed.