PT-2020-19691 · Ruby+5 · Websocket-Extensions+5

Robert Mclaughlin · Published 2020-06-02 · Updated 2026-03-13 · CVE-2020-7663

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions websocket-extensions ruby module versions prior to 0.1.5

Description The issue allows for Denial of Service (DoS) via Regex Backtracking. An attacker can exploit this by providing a malicious payload with the Sec-WebSocket-Extensions header, containing an unclosed string parameter value with a repeating two-byte sequence of a backslash and some other character. This can exhaust the server's capacity to process incoming requests, rendering the service completely unavailable, especially on single-threaded servers.

Recommendations For versions prior to 0.1.5, upgrade to version 0.1.5 to resolve the issue. As a temporary workaround, consider disabling any public-facing WebSocket functionality until the upgrade is applied.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2025-09009

CVE-2020-7663

DLA-2334-1

GHSA-G6WQ-QCWM-J5G2

OESA-2022-1553

OESA-2022-2093

OPENSUSE-SU-2023_0127-1

OPENSUSE-SU-2024:11357-1

OPENSUSE-SU-2024:13173-1

OPENSUSE-SU-2024:14180-1

OPENSUSE-SU-2025:15130-1

OPENSUSE-SU-2026:10368-1

RHSA-2020:4366

SNYK-RUBY-WEBSOCKETEXTENSIONS-570830

SUSE-SU-2023:0127-1

SUSE-SU-2023_0127-1

USN-4502-1

Affected Products

Astra Linux

Linuxmint

Red Os

Suse

Ubuntu

Websocket-Extensions

References · 38

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-extensions/CVE-2020-7663.yml · Exploit
• 🔥 https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830 · Exploit
• https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b · Patch
• https://usn.ubuntu.com/4502-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09009 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1553 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4502-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7663 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0127-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7663 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10368-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2093 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7663 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14180-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2334-1 · Vendor Advisory