websocket-driver-ruby: Denial of service via malformed Host header

ÉLEVÉE 8.9CVE-2026-61666 · GHSA-2x63-gw47-w4mm · Published 17/08/2026 · updated 23/10/2026

En bref

CVE-2026-61666 est une vulnérabilité ÉLEVÉE (CVSS 8.9) touchant websocket-driver.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.45%, plus élevée que 38.8% des vulnérabilités.
Correctif : mettre à jour vers 0.8.2 ou plus récent.

Package	Affected versions	Patched versions
websocket-driver RubyGems	`< 0.8.2`	`0.8.2`

Description

Impact

If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server() method, then a client can cause the server to crash by sending a Host header that is not a valid host[:port] string. When this happens, a URI::InvalidURIError exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the parse() method itself.

Patches

The issue has been patched in version 0.8.2 by making the request parser catch URI::InvalidURIError and enter an error state if the Host header is malformed. This means the request is considered invalid and should not establish a WebSocket connection.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

NVD description

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.