{
  "id": "gorilla-websocket-cve-2020-27813",
  "publication": "public",
  "reviewedAt": "2026-10-20",
  "type": "historical",
  "status": "detected",
  "package": "github.com/gorilla/websocket",
  "ecosystem": "Go",
  "title": {
    "zh": "訊框長度整數溢位繞過讀取上限",
    "en": "Frame length integer overflow bypasses the read limit"
  },
  "summary": {
    "zh": "64 位元訊框長度轉成有號整數後可能變負數，讓 SetReadLimit 的檢查失效，伺服器可能被耗盡記憶體。",
    "en": "A 64-bit frame length converted to a signed integer can turn negative and defeat the SetReadLimit check, letting a peer exhaust server memory."
  },
  "cve": "CVE-2020-27813",
  "ghsa": "GHSA-3xh2-74w9-5vxm",
  "cwe": "CWE-190",
  "sourceVersion": "v1.4.0",
  "fixedVersion": "v1.4.1",
  "sourceUrl": "https://github.com/gorilla/websocket/blob/v1.4.0/conn.go",
  "advisoryUrl": "https://github.com/advisories/GHSA-3xh2-74w9-5vxm",
  "fixUrl": "https://github.com/gorilla/websocket/commit/5b740c29263eb386f33f265561c8262522f19d37",
  "publishedAt": "2019-08-25",
  "boundary": {
    "zh": "v1.4.0 封存檔掃描在 conn.go:843（advanceFrame 的 64 位元長度）提出 CWE-190 候選，符合預先登錄的標準。grok 覆核在 600 秒逾時，沒有判定，所以狀態停在 candidate。修補版 v1.4.1 同參數掃描，對應範圍沒有符合 CWE 清單的輸出。",
    "en": "The v1.4.0 archive scan raised a CWE-190 candidate at conn.go:843 (the 64-bit length in advanceFrame), meeting the registered criteria. The grok verifier timed out after 600 seconds with no verdict, so the status stayed candidate. The fixed v1.4.1 scan with the same parameters produced nothing in the corresponding range with a listed CWE."
  },
  "method": {
    "zh": "從官方套件庫下載脆弱版與修補版的發布封存檔，核對 SHA-256 後掃描整個樹，沒有 git 歷史。兩版用同一組參數：deep profile、claude 找洞、grok 與 agy（GPT-OSS）跨家族覆核、最多 8 個審查單元、每個候選覆核 1 次、PoC 關閉。模型輸入不含 CVE 編號、公告文字或修補 diff，兩版都先移除 changelog。比對標準（檔案、行號範圍、CWE 清單）在 2026-10-20 12:51 UTC 公開提交，第一次掃描在 29 秒後開始。登錄檔內的 registeredAt 寫 12:55，是提交前手填的估計，與實際不符；以提交時間為準，檔案沒有再改，所以雜湊不變。",
    "en": "Official release archives of the vulnerable and fixed versions were downloaded from the package registry, checked against SHA-256 and scanned as whole trees without git history. Both arms used the same parameters: deep profile, claude as finder, grok and agy (GPT-OSS) as cross-family verifiers, at most 8 audit units, one verifier run per candidate, PoC off. Model input contained no CVE id, advisory text or fix diff, and changelog files were removed from both arms. Match criteria (file, line ranges, CWE list) were committed publicly at 12:51 UTC on 2026-10-20; the first scan started 29 seconds later. The registeredAt field inside the file says 12:55; it was a hand-typed estimate made before the commit and is wrong. The commit time is authoritative, and the file was left unchanged so its digest still matches."
  },
  "limitations": {
    "zh": "模型可能在訓練時看過這份公告或修補，所以命中不能證明它是從程式碼推理出來的。候選與 needs_human 都不是自動確認，這次也沒有跑 PoC 或任何利用。單次執行，模型輸出有隨機性。五筆案例是挑過的已知漏洞，不能拿來推估召回率或誤報率。其他輸出只公開數量，沒有審閱。原始 report.json 與 trace 不公開，只列 SHA-256。表格的執行狀態照錄產品回報；incomplete 代表有單元延後、截斷、失敗或沒能交叉核對，原因列在旁邊，但每一臂的目標檔都有送審。修補版「未被標記」只表示對應範圍沒有符合 CWE 清單、且沒被駁回的輸出，同一臂的其他輸出沒有審閱，不能當成修補版沒有其他問題。這筆候選沒有完成跨家族覆核（逾時），比其他四筆少一層檢查。",
    "en": "The models may have seen this advisory or its fix during training, so a match does not show that they reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC or exploit was run. This was a single run and model output is nondeterministic. Five hand-picked known issues cannot support a recall or false-positive rate. Other output is published as counts only and was not reviewed. The raw report.json and trace are not public; only their SHA-256 is listed. The run status in the table is what the product reported: incomplete means some unit was deferred, truncated, failed or could not be cross-checked, with the reason shown, but the target file was sent for review in every arm. On the fixed release, \"not flagged\" only means no unrefuted output in the corresponding range carried a listed CWE; the other output in that arm was not reviewed and says nothing about the fixed release being free of other issues. This candidate has no completed cross-family review (timeout), one check fewer than the other four."
  },
  "credit": {
    "zh": "公告寫明由 Max Justicz 發現並通報；修補歸屬見 gorilla/websocket 公告。Vettalon 只做已知漏洞的識別測試。",
    "en": "The advisory credits Max Justicz with discovering and reporting the issue; see the gorilla/websocket advisory for fix credits. Vettalon performed detection of a known issue only."
  },
  "timeline": [
    {
      "date": "2019-08-25",
      "event": {
        "zh": "gorilla/websocket 儲存庫公告發布",
        "en": "gorilla/websocket repository advisory published"
      }
    },
    {
      "date": "2026-10-20",
      "event": {
        "zh": "公開登錄比對標準後，掃描脆弱版與修補版封存檔",
        "en": "Match criteria registered publicly; vulnerable and fixed release archives scanned"
      }
    }
  ],
  "detection": {
    "mode": "release-archive",
    "observedAt": "2026-10-20",
    "finder": "claude-opus-5-5 (Anthropic)",
    "toolVersion": "vettalon 0.3.0 (built from source on 2026-10-20)",
    "modelVersions": "Finder claude-opus-5-5 (claude CLI 2.1.300); verifiers grok-4.7 (grok CLI 1.0.62) and gpt-oss-120b-medium (agy 1.4.3)",
    "scope": "Whole release archive, no git history; up to 8 audit units; changelog files removed from both arms; L0 (no CWE, location or advisory hint)",
    "rerun": "curl -sSfLo release-archive https://proxy.golang.org/github.com/gorilla/websocket/@v/v1.4.0.zip\nshasum -a 256 release-archive   # expect 937dac399bca2f88344c31ee295cd57310244bc1a3a58e8bcb14ab26a6009d0e\nmkdir release-tree && bsdtar -xf release-archive --strip-components 3 -C release-tree\n# remove the files listed under \"excluded\" in the pre-registration, then:\nvettalon scan ./release-tree --profile deep --config ./config.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --report ./result.json",
    "findingStatus": "candidate",
    "file": "conn.go",
    "line": 843,
    "sha256": "a75bb0c859555fe2e77114a6ac9278b41d96643fe736b01b36cce6b57869a421",
    "claim": {
      "zh": "64 位元訊框長度的有號溢位可繞過 SetReadLimit，造成記憶體無上限消耗。",
      "en": "Signed overflow of the 64-bit frame length bypasses SetReadLimit, allowing unbounded memory consumption."
    },
    "reviewerConclusion": {
      "zh": "grok：no_verdict。覆核呼叫 600 秒逾時，沒有有效判定，結論停在 candidate。",
      "en": "grok: no_verdict. The verifier call timed out after 600 seconds with no valid verdict, leaving a candidate."
    },
    "reviewer": "grok-4.7 (xAI): no_verdict (timeout)"
  },
  "benchmark": {
    "artifactPath": "/evidence/benchmarks/historical-detection-20261020/gorilla-websocket-cve-2020-27813.json",
    "runAt": "2026-10-20",
    "sha256": "a6bdc3216215625191bdc9ba4d51b0a7f35e9401492d64364130dce857507c24",
    "vulnerable": {
      "outcome": "found",
      "calls": 11,
      "runStatus": "incomplete",
      "incompleteReason": "units_failed",
      "targetReviewed": true
    },
    "fixed": {
      "outcome": "notFlagged",
      "calls": 12,
      "runStatus": "incomplete",
      "incompleteReason": "scope_not_fully_reviewed",
      "targetReviewed": true
    }
  },
  "review": {
    "reviewer": "zhixuli0406",
    "reviewedAt": "2026-10-20",
    "aiUse": {
      "zh": "找洞與覆核由 AI 模型執行（找洞為 claude-opus-5-5，覆核為 grok-4.7 與 agy 上的 gpt-oss-120b-medium），結論停在 needs_human 或 candidate，AI 判定不視為確認。比對標準在第一次掃描前登錄。本頁紀錄文字由 AI 程式助理協助整理，經人工審閱者對照公開來源核對後發布。",
      "en": "Finding and verification were run by AI models (finder claude-opus-5-5; verifiers grok-4.7 and gpt-oss-120b-medium via agy). Results stop at needs_human or candidate; an AI verdict is not treated as confirmation. Match criteria were registered in advance. This record was drafted with AI coding assistants and published after the human reviewer checked it against public sources."
    }
  }
}