Is CVE-2026-54463 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54463 being exploited in the wild.

How severe is CVE-2026-54463?

Medium severity, with a CVSS score of 4, published 17 July 2026.

Which products and versions are affected?

Faye Project Websocket-Driver-Ruby < 0.8.1; websocket-driver (RubyGems) < 0.8.1, ECOSYSTEM:introduced=0,fixed=0.8.1.

Is there a fix for CVE-2026-54463?

Yes. websocket-driver (RubyGems): upgrade to 0.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54463 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54463?

Check whether you run Faye Project Websocket-Driver-Ruby or websocket-driver (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54463: faye websocket-driver-ruby memory exhaustion in draft protocol handler

Q: Is there a fix for CVE-2026-54463?

Yes. websocket-driver (RubyGems): upgrade to 0.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54463 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54463?

Check whether you run Faye Project Websocket-Driver-Ruby or websocket-driver (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54463 · Severity: medium · CVSS 4 · Published 2026-07-17

The websocket-driver library, used to handle real-time web communications, is vulnerable to a memory exhaustion attack. An attacker can send a specially crafted sequence of data that causes the application to consume all available system memory. This can lead to the application crashing or becoming unresponsive, resulting in a denial of service for all users.

Technologies: websocket-driver (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54463 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54463 being exploited in the wild.
How severe is CVE-2026-54463?: Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?: Faye Project Websocket-Driver-Ruby < 0.8.1; websocket-driver (RubyGems) < 0.8.1, ECOSYSTEM:introduced=0,fixed=0.8.1.
Is there a fix for CVE-2026-54463?: Yes. websocket-driver (RubyGems): upgrade to 0.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54463 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54463?: Check whether you run Faye Project Websocket-Driver-Ruby or websocket-driver (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

websocket-driver (RubyGems): upgrade to 0.8.1 or later
```
bundle update websocket-driver
```

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the websocket-driver Ruby library due to improper handling of length headers in draft versions (75/76) of the WebSocket protocol. Because Ruby integers have arbitrary precision, an attacker can provide an indefinite sequence of bytes with the high bit set (0x80 or higher), which the parser continuously accumulates into an ever-growing integer. This process consumes unbounded memory, eventually leading to a Denial of Service (DoS) via Out-of-Memory (OOM) termination of the host process. The vulnerability can be triggered by any unauthenticated network peer (client or server) during the protocol handshake/parsing phase. The issue is resolved in version 0.8.1 by enforcing a maximum length limit on these headers.

Affected products

faye websocket-driver-ruby < 0.8.1

Identifiers

CVE-2026-54463
GHSA-ghhp-3qvg-889p

Timeline

2026-06-04: advisory: GitHub Security Advisory published
2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.