Executive brief
The websocket-driver library, used to handle real-time web communications, is vulnerable to a memory exhaustion attack. An attacker can send a specially crafted sequence of data that causes the application to consume all available system memory. This can lead to the application crashing or becoming unresponsive, resulting in a denial of service for all users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the websocket-driver Ruby library due to improper handling of length headers in draft versions (75/76) of the WebSocket protocol. Because Ruby integers have arbitrary precision, an attacker can provide an indefinite sequence of bytes with the high bit set (0x80 or higher), which the parser continuously accumulates into an ever-growing integer. This process consumes unbounded memory, eventually leading to a Denial of Service (DoS) via Out-of-Memory (OOM) termination of the host process. The vulnerability can be triggered by any unauthenticated network peer (client or server) during the protocol handshake/parsing phase. The issue is resolved in version 0.8.1 by enforcing a maximum length limit on these headers.
Affected products
- faye websocket-driver-ruby < 0.8.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD