websocket-driver EUVD-2026-45309

Exploitation requires two conditions to be simultaneously true: (1) the permessage-deflate WebSocket extension (RFC 7692) must be negotiated and active on the connection - this is a server or client configuration choice, not universally enabled by default; and (2) the application must have configured a maximum message size limit, which is the guard being bypassed. If either condition is absent the vulnerability is unexploitable. No authentication is required - any peer that can complete a WebSocket handshake with permessage-deflate negotiated can send the crafted payload. Exploitation is limited strictly to Ruby applications using websocket-driver versions below 0.8.1 with the compression extension in use; applications on 0.8.1 or later, or those that do not enable permessage-deflate, are fully unaffected.

No official CVSS score was published; all metric assessment is inferred from the advisory description and CWE. The attack requires permessage-deflate to be negotiated during the handshake - not universal but common in bandwidth-sensitive or real-time deployments. When that condition is met, exploitability is high: crafting a DEFLATE-compressed payload that undercuts the size check while decompressing large is trivially reproducible from public knowledge of the attack class. No authentication or user interaction is required against a publicly exposed WebSocket endpoint. No EPSS score or KEV listing is available, and no POC has been publicly confirmed, so widespread active exploitation is unconfirmed. Real-world risk is most acute for services with public or semi-public WebSocket endpoints that rely on message size limits as a resource-protection mechanism; the risk is negligible for deployments that do not enable permessage-deflate. The impact is limited to availability - no confidentiality or integrity exposure is indicated.

An attacker connects to a publicly accessible WebSocket endpoint, successfully negotiates the permessage-deflate extension during the handshake, then sends a crafted message that is compressed to a size below the server's configured maximum message size threshold. Upon decompression, the payload expands to a size far exceeding the limit - potentially hundreds of times larger - consuming server memory and CPU. Repeated delivery of such frames can exhaust available resources and cause a denial of service. No public POC has been confirmed, but the attack is mechanically equivalent to well-documented decompression bomb techniques.