nhooyr.io/websocket is a minimal and idiomatic WebSocket library for Go.
-Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping.
- If the second pong arrived before the ping goroutine deleted its channel from the map, the channel would be closed twice and a panic would
- occur.
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
-Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
-One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
-When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
-Two common types of DoS vulnerabilities:
-High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
-Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package
Upgrade nhooyr.io/websocket to version 1.8.7 or higher.