Executive brief
A vulnerability in the websocket-driver library can allow an attacker to crash a server or client application by exhausting its available memory. This occurs when the library is used to handle WebSocket connections and receives a specially crafted request with an endless list of headers. An exploit could lead to a denial-of-service, making the affected application or service unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in websocket-driver prior to version 0.8.1. When the library is used to implement a WebSocket server via WebSocket::Driver.server() or as a client complement, the HTTP header parser fails to enforce limits on the number or size of incoming headers. A remote attacker can exploit this by sending a continuous stream of HTTP headers, causing the process to allocate memory indefinitely until it crashes or becomes unresponsive. The issue is resolved in version 0.8.1 by implementing a 32 KB limit on the total size of the HTTP request/reponse line and headers.
Affected products
- faye websocket-driver-ruby < 0.8.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published by maintainer
- 2026-07-17: disclosed: CVE-2026-54465 published to NVD
- 2026-07-17: patched: Version 0.8.1 released with fix