Skip to main content

websocket-driver CVE-2026-54464

| EUVDEUVD-2026-45309 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-15 https://github.com/faye/websocket-driver-ruby GHSA-33ph-fccm-39pj
Denial Of Service Red Hat Suse
6.3
CVSS 4.0 · Vendor: https://github.com/faye/websocket-driver-ruby
Share

Severity by source

Vendor (https://github.com/faye/websocket-driver-ruby) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable WebSocket endpoint, no auth required, trivially crafted payload; pure availability impact via resource exhaustion, no C or I exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (https://github.com/faye/websocket-driver-ruby).

CVSS VectorVendor: https://github.com/faye/websocket-driver-ruby

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jul 17, 2026 - 20:22 NVD
6.3 (MEDIUM)
Source Code Evidence Fetched
Jul 15, 2026 - 22:31 vuln.today
Analysis Generated
Jul 15, 2026 - 22:31 vuln.today

DescriptionCVE.org

Impact

If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.

Patches

The issue has been patched in version 0.8.1, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

AnalysisAI

Resource exhaustion in the websocket-driver Ruby gem (faye/websocket-driver-ruby) allows any WebSocket peer to bypass a configured maximum message size when the permessage-deflate compression extension is in use. The size limit is enforced against the compressed frame length rather than the post-decompression size, enabling a decompression-bomb style attack where a small compressed payload expands far beyond the intended ceiling. Applications on versions below 0.8.1 silently accept oversized payloads, potentially exhausting server memory or CPU and causing a denial-of-service condition. No public exploit exists at time of analysis, but the attack class is well understood and low-complexity to implement.

Technical ContextAI

websocket-driver (rubygems/websocket-driver, CPE: pkg:rubygems/websocket-driver) is a Ruby library implementing the WebSocket protocol (RFC 6455). The permessage-deflate extension (RFC 7692) negotiated during the WebSocket handshake applies per-message DEFLATE compression to reduce wire bandwidth. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the maximum message size check reads the length field from the compressed frame headers before the extension pipeline decompresses the payload. A well-compressed payload can therefore pass the size guard while expanding orders of magnitude in memory - a classic decompression bomb pattern applied to the WebSocket layer. The fix in 0.8.1 relocates the size check to after extension processing, so the decompressed length is what is bounded.

RemediationAI

Upgrade websocket-driver to version 0.8.1 or later - the vendor-confirmed fix that relocates the message size check to occur after decompression by incoming extensions (https://github.com/faye/websocket-driver-ruby/releases/tag/0.8.1). The advisory explicitly states no known workarounds exist. If an immediate upgrade is blocked, disabling the permessage-deflate extension in the WebSocket server or client configuration eliminates the vulnerable code path entirely, at the cost of increased wire bandwidth. As a partial mitigation, enforcing connection-level rate limits and payload rate throttling at a reverse proxy or load balancer can reduce the speed at which a decompression bomb depletes server memory, but this does not prevent the size limit bypass itself and should not be treated as a substitute for patching.

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-54464 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy