What’s Vulnerable › Vulnerabilities

CVE-2021-4236: Panic or authentication bypass in github.com/ecnepsnai/web

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-27 · updated 2026-06-17
• Weakness: CWE-476

Description

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.

Affected products

• github.com/ecnepsnai/web: from 1.4.0 before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: github.com/ecnepsnai/web 1.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f
• https://pkg.go.dev/vuln/GO-2021-0107
• https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f
• https://pkg.go.dev/vuln/GO-2021-0107

Get alerted when CVE-2021-4236 or the next vulnerability affects your stack