Advisory Database
  • Advisories
  • Dependency Scanning
  1. gem
  2. ›
  3. websocket-driver
  4. ›
  5. CVE-2026-61666

CVE-2026-61666: websocket-driver-ruby: Denial of service via malformed Host header

July 21, 2026

If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server() method, then a client can cause the server to crash by sending a Host header that is not a valid host[:port] string. When this happens, a URI::InvalidURIError exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the parse() method itself.

References

  • github.com/advisories/GHSA-2x63-gw47-w4mm
  • github.com/faye/websocket-driver-ruby/commit/7d6fd87759a2fdc83590d3b49ffa661dc53fa128
  • github.com/faye/websocket-driver-ruby/security/advisories/GHSA-2x63-gw47-w4mm
  • nvd.nist.gov/vuln/detail/CVE-2026-61666

Code Behaviors & Features

Detect and mitigate CVE-2026-61666 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.8.2

Fixed versions

  • 0.8.2

Solution

Upgrade to version 0.8.2 or above.

Impact 8.6 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-248: Uncaught Exception

Source file

gem/websocket-driver/CVE-2026-61666.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 22 Jul 2026 12:18:28 +0000.