What’s Vulnerable › Vulnerabilities

CVE-2026-61666: websocket-driver: Denial of service via malformed Host header

• Severity: high (CVSS 8.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-10-23
• Weakness: CWE-248

Description

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.

Affected products

• Rubygems Websocket-Driver: before 0.8.2; 0.1.0, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.3.0 (+27) — fixed in 0.8.2
• faye websocket-driver-ruby: before 0.8.2

How to fix

Upgrade to a fixed version: Rubygems Websocket-Driver 0.8.2. Check the vendor advisory for mitigations.

References

• https://github.com/faye/websocket-driver-ruby/commit/7d6fd87759a2fdc83590d3b49ffa661dc53fa128
• https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-2x63-gw47-w4mm

Get alerted when CVE-2026-61666 or the next vulnerability affects your stack