Executive brief
A vulnerability in the websocket-driver-ruby library can allow a remote attacker to crash a WebSocket server. By sending a specially crafted request with a malformed Host header, an attacker can trigger an unhandled error that shuts down the server process. This results in a denial-of-service, making the application or service unavailable to legitimate users.
Technical details
The vulnerability is an uncaught exception (CWE-248) in the `WebSocket::Driver.server()` method of the websocket-driver-ruby library. When the library parses an incoming WebSocket connection request, a malformed `Host` header that does not conform to the expected `host[:port]` format triggers a `URI::InvalidURIError`. If the calling application does not explicitly catch this error from the `parse()` method, the Ruby process will terminate. This can be exploited by a remote, unauthenticated attacker to cause a denial-of-service (DoS) condition. The issue is fixed in version 0.8.2 by ensuring the parser catches the exception and enters an error state instead of crashing.
Affected products
- faye websocket-driver-ruby < 0.8.2
Timeline
- 2026-06-23: disclosed
- 2026-07-21: advisory: GitHub Advisory published
- 0.8.2: patched
References
- https://api.github.com/users/pranjalithakur
- https://github.com/pranjalithakur
- https://api.github.com/users/pranjalithakur/gists%7B/gist_id%7D
- https://api.github.com/users/pranjalithakur/repos
- https://avatars.githubusercontent.com/u/47360190?v=4
- https://api.github.com/users/pranjalithakur/events%7B/privacy%7D