websocket-driver EUVD-2026-45311

The affected package is rubygems/websocket-driver, the Faye project's pure-Ruby WebSocket protocol implementation. During the WebSocket upgrade handshake, an HTTP parser processes incoming request or response lines and headers. Prior to version 0.8.1, this parser imposed no cumulative size limit on the header block, meaning each additional header line allocated more heap memory with no ceiling. CWE-400 (Uncontrolled Resource Consumption) precisely describes this root cause: the resource (memory) consumed is proportional to attacker-controlled input (header count/size) with no enforced upper bound. The fix introduced in 0.8.1 caps total HTTP request/response line and header data at 32 kB, a standard defensive threshold. The vulnerability only manifests in code paths where websocket-driver itself owns the raw TCP stream and runs its own HTTP parser - when embedded inside an existing HTTP server or framework, that framework's parser enforces its own limits before websocket-driver sees the data.