What’s Vulnerable › Vulnerabilities
CVE-2020-7663: Regular Expression Denial of Service in websocket-extensions (RubyGem)
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-06-02 · updated 2026-06-17
Description
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Affected products
- Canonical Ubuntu Linux: 16.04, 18.04, 20.04
- Debian Linux: 9.0
- websocket-extensions (npm): before 0.1.5 — fixed in 0.1.5
- Rubygems Websocket-Extensions: before 0.1.5; 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4 — fixed in 0.1.5
How to fix
Upgrade to a fixed version: websocket-extensions (npm) 0.1.5; Rubygems Websocket-Extensions 0.1.5. Check the vendor advisory for mitigations.
References
- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
- https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b
- https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
- https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html
- https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
- https://usn.ubuntu.com/4502-1/
- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
- https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b
- https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
- https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html
- https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
- https://usn.ubuntu.com/4502-1/
Get alerted when CVE-2020-7663 or the next vulnerability affects your stack