EUVD-2026-60264
GHSA-2x63-gw47-w4mm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, no authentication or interaction required, scope unchanged; sole impact is total availability loss via process crash, no confidentiality or integrity component.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/faye/websocket-driver-ruby).
CVSS VectorVendor: https://github.com/faye/websocket-driver-ruby
Lifecycle Timeline
6DescriptionCVE.org
Impact
If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server() method, then a client can cause the server to crash by sending a Host header that is not a valid host[:port] string. When this happens, a URI::InvalidURIError exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the parse() method itself.
Patches
The issue has been patched in version 0.8.2 by making the request parser catch URI::InvalidURIError and enter an error state if the Host header is malformed. This means the request is considered invalid and should not establish a WebSocket connection.
Workarounds
No known workarounds exist.
Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.
AnalysisAI
Denial of service in websocket-driver-ruby (all versions before 0.8.2) allows any unauthenticated remote client to crash a Ruby WebSocket server process by sending an HTTP Upgrade request containing a syntactically invalid Host header value. The root cause is an unhandled URI::InvalidURIError exception raised during Host header parsing in the request.complete() method, which propagates uncaught to the top level and terminates the server process. No public exploit has been identified at time of analysis, but the attack technique is trivially constructible from the CVE description and the published patch diff alone.
Technical ContextAI
The websocket-driver-ruby gem (pkg:rubygems/websocket-driver) implements the WebSocket protocol framing and HTTP upgrade handshake for Ruby applications, serving as the underlying engine for the faye-websocket gem and Rails ActionCable. In server mode (WebSocket::Driver.server()), the library parses the incoming HTTP Upgrade request in lib/websocket/http/request.rb. The complete() method extracts the HTTP_HOST header and calls Ruby's standard URI.parse() to decompose it into SERVER_NAME and SERVER_PORT components. Ruby's URI module raises URI::InvalidURIError for strings containing characters or structures that violate RFC 3986, and prior to version 0.8.2 no rescue clause existed in this code path. CWE-248 (Uncaught Exception) precisely describes the flaw: an exception escapes the library boundary and propagates into the application layer, crashing the process unless the caller explicitly rescues from parse() - an expectation not documented to consumers of the library.
RemediationAI
Upgrade the websocket-driver-ruby gem to version 0.8.2 or later, which is confirmed as the vendor-released fix per the GitHub Security Advisory GHSA-2x63-gw47-w4mm. The patch (commit 7d6fd87759a2fdc83590d3b49ffa661dc53fa128, available at https://github.com/faye/websocket-driver-ruby/commit/7d6fd87759a2fdc83590d3b49ffa661dc53fa128) adds a rescue URI::InvalidURIError block in lib/websocket/http/request.rb that causes the parser to enter an error state and reject the connection rather than raising. No vendor-documented workarounds exist. As a fragile interim measure only, application developers can wrap their own calls to parse() in a rescue block to prevent process termination, but this requires application-level changes and does not fix the underlying library defect - upgrade to 0.8.2 remains the only reliable remediation.
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise High Availability Extension 15 SP7 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today