Advisory Database
  • Advisories
  • Dependency Scanning
  1. gem
  2. ›
  3. websocket-driver
  4. ›
  5. CVE-2026-54464

CVE-2026-54464: websocket-driver: Resource limit bypass via message compression

July 15, 2026

If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames’ length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.

References

  • github.com/advisories/GHSA-33ph-fccm-39pj
  • github.com/faye/websocket-driver-ruby/releases/tag/0.8.1
  • github.com/faye/websocket-driver-ruby/security/advisories/GHSA-33ph-fccm-39pj
  • github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-driver/CVE-2026-54464.yml
  • nvd.nist.gov/vuln/detail/CVE-2026-54464
  • www.cve.org/CVERecord/SearchResults?query=CVE-2026-54464

Code Behaviors & Features

Detect and mitigate CVE-2026-54464 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.8.1

Fixed versions

  • 0.8.1

Solution

Upgrade to version 0.8.1 or above.

Impact 5.8 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-770: Allocation of Resources Without Limits or Throttling

Source file

gem/websocket-driver/CVE-2026-54464.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 16 Jul 2026 12:18:45 +0000.