websocket-driver-ruby CVE-2026-61666

The target application must be using websocket-driver-ruby in server mode - specifically calling WebSocket::Driver.server() to handle incoming WebSocket connections on top of a TCP server. Applications using the library only in client mode (WebSocket::Driver.client()) are not affected. The attacker must be able to reach the WebSocket endpoint over the network and complete a TCP connection to send an HTTP Upgrade request. The CVSS 4.0 AT:P metric captures this deployment-mode prerequisite. Exploitation is further limited by the requirement that the application itself does not rescue exceptions from the parse() method - any application that already wraps parse() in a broad rescue block will not crash. No authentication is required and no specific platform or OS is needed; the flaw is purely in Ruby gem logic.

The CVSS 4.0 score of 8.9 is credible and appropriately weighted. AV:N/AC:L/PR:N/UI:N confirms the attack requires no authentication and no victim interaction - a single malformed TCP request is sufficient. AT:P (Attack Prerequisites: Present) in CVSS 4.0 correctly identifies the limiting condition: only applications using WebSocket::Driver.server() are vulnerable. VA:H and SA:H reflect that a crash terminates the server process, denying service to all connected clients and downstream services. No EPSS data was provided; the CVE is not in CISA KEV, so no confirmed active exploitation exists at time of analysis. Despite the absence of a KEV listing, real-world risk is elevated because the triggering payload is trivial - no memory corruption, no gadget chaining, just a single malformed header value - meaning even a mid-sized municipal IT team in bytom running Ruby WebSocket infrastructure should treat this as urgent rather than waiting for a KEV confirmation. The absence of confidentiality or integrity impact caps the damage to service disruption, but repeated or automated requests could achieve sustained, difficult-to-mitigate denial of service against exposed endpoints.

An unauthenticated attacker sends a TCP connection to an exposed Ruby WebSocket server and issues an HTTP Upgrade request where the Host header contains a URI-illegal string such as a bare bracket character or an embedded space. The websocket-driver-ruby request parser calls URI.parse() on the value, Ruby raises URI::InvalidURIError, and because no rescue exists in the library prior to 0.8.2, the exception propagates out of parse() and terminates the server process. No public exploit code has been identified at time of analysis, but the attack is trivially constructible without tooling beyond a standard TCP client.