PT-2026-63317 · Rubygems · Websocket-Driver
CVE-2026-61666
·
Publicado
2026-07-21
·
Atualizado
2026-07-21
CVSS v4.0
8.9
Alta
| Vetor | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
Impact
If this library is used to implement a WebSocket server on top of a TCP server, by using the
WebSocket::Driver.server() method, then a client can cause the server to crash by sending a Host header that is not a valid host[:port] string. When this happens, a URI::InvalidURIError exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the parse() method itself.Patches
The issue has been patched in version 0.8.2 by making the request parser catch
URI::InvalidURIError and enter an error state if the Host header is malformed. This means the request is considered invalid and should not establish a WebSocket connection.Workarounds
No known workarounds exist.
Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Websocket-Driver