Frame length integer overflow bypasses the read limit

Test method

Official release archives of the vulnerable and fixed versions were downloaded from the package registry, checked against SHA-256 and scanned as whole trees without git history. Both arms used the same parameters: deep profile, claude as finder, grok and agy (GPT-OSS) as cross-family verifiers, at most 8 audit units, one verifier run per candidate, PoC off. Model input contained no CVE id, advisory text or fix diff, and changelog files were removed from both arms. Match criteria (file, line ranges, CWE list) were committed publicly at 12:51 UTC on 2026-10-20; the first scan started 29 seconds later. The registeredAt field inside the file says 12:55; it was a hand-typed estimate made before the commit and is wrong. The commit time is authoritative, and the file was left unchanged so its digest still matches.

Mode

release-archive

Finding status

candidate

Location

conn.go:843

Public detection evidence snapshot

Signed overflow of the 64-bit frame length bypasses SetReadLimit, allowing unbounded memory consumption.

grok: no_verdict. The verifier call timed out after 600 seconds with no valid verdict, leaving a candidate.

Finder

claude-opus-5-5 (Anthropic)

Verifier and verdict

grok-4.7 (xAI): no_verdict (timeout)

Tool version

vettalon 0.3.0 (built from source on 2026-10-20)

Model versions

Finder claude-opus-5-5 (claude CLI 2.1.300); verifiers grok-4.7 (grok CLI 1.0.62) and gpt-oss-120b-medium (agy 1.4.3)

Historical scope

Whole release archive, no git history; up to 8 audit units; changelog files removed from both arms; L0 (no CWE, location or advisory hint)

Rerun detection

Install the Vettalon CLI and configure your models and credentials in config.toml. These steps download the official release archive, check its SHA-256 and scan the whole tree; the pre-registration lists excluded files. Model and rule versions may differ; identical results are not guaranteed. Deep mode sends source to configured models. This is detection only; it does not run the upstream project or verify exploitation.

curl -sSfLo release-archive https://proxy.golang.org/github.com/gorilla/websocket/@v/v1.4.0.zip
shasum -a 256 release-archive   # expect 937dac399bca2f88344c31ee295cd57310244bc1a3a58e8bcb14ab26a6009d0e
mkdir release-tree && bsdtar -xf release-archive --strip-components 3 -C release-tree
# remove the files listed under "excluded" in the pre-registration, then:
vettalon scan ./release-tree --profile deep --config ./config.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --report ./result.json

Pre-registered release-archive scan

Both arms scan the official release archive (no git history) with the same parameters. Model input contains no CVE id, advisory text or fix diff. A match is judged against the file, line ranges and CWE registered publicly before the first scan; other output is listed as counts only and was not reviewed. "Not flagged" on the fixed release only means nothing in the corresponding range met the criteria. The models may have seen this advisory during training, and a candidate is not an automatic confirmation.

Match criteria were registered publicly before the first scan: Pre-registration (JSON)

Limits and prerequisites

The models may have seen this advisory or its fix during training, so a match does not show that they reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC or exploit was run. This was a single run and model output is nondeterministic. Five hand-picked known issues cannot support a recall or false-positive rate. Other output is published as counts only and was not reviewed. The raw report.json and trace are not public; only their SHA-256 is listed. The run status in the table is what the product reported: incomplete means some unit was deferred, truncated, failed or could not be cross-checked, with the reason shown, but the target file was sent for review in every arm. On the fixed release, "not flagged" only means no unrefuted output in the corresponding range carried a listed CWE; the other output in that arm was not reviewed and says nothing about the fixed release being free of other issues. This candidate has no completed cross-family review (timeout), one check fewer than the other four.

Sources and attribution

The advisory credits Max Justicz with discovering and reporting the issue; see the gorilla/websocket advisory for fix credits. Vettalon performed detection of a known issue only.