Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-54463 EUVD-2026-45310GHSA-ghhp-3qvg-889p

websocket-driver: Memory exhaustion via abuse of protocol length headers

Published Jul 17, 2026 · Updated Jul 20, 2026 · Assigned by GitHub_M

Description

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an indefinite sequence of 0x80 or higher bytes that the peer parses into an ever-growing Ruby integer. This can make a WebSocket connection consume an unbounded amount of memory and lead to the host process running out of memory. This issue is fixed in version 0.8.1.

Affected products

VendorProductAffectedFixed
faye websocket-driver-ruby < 0.8.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ruby-websocket-driver 0.8.1-1 —
Debian 13 ruby-websocket-driver No fix yet —
Debian 12 ruby-websocket-driver No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ruby-websocket-driver No fix yet —
Ubuntu 26.04 LTS ruby-websocket-driver No fix yet —
Ubuntu 24.04 LTS ruby-websocket-driver No fix yet —
Ubuntu 22.04 LTS ruby-websocket-driver No fix yet —
Ubuntu 20.04 LTS ruby-websocket-driver No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS ruby-websocket-driver No fix yet —
Ubuntu 16.04 LTS ruby-websocket-driver No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems websocket-driver < 0.8.1 0.8.1 GHSA-ghhp-3qvg-889p

References