CVE-2026-54465mediumCWE-770

CVE-2026-54465: falha de média gravidade em faye websocket-driver-ruby

websocket-driver: Memory exhaustion in HTTP header parser

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar websocket-driver-ruby+ Monitorar ruby-websocket-driver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server() or to complement a WebSocket client, a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory. This issue is fixed in version 0.8.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Produtos afetados
faye · websocket-driver-ruby
CVEs relacionadas — faye websocket-driver-ruby

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54463MEDIUMwebsocket-driver: Memory exhaustion via abuse of protocol length headersEPSS 0.5%CVE-2026-61666HIGHwebsocket-driver: Denial of service via malformed Host headerEPSS 0.4%CVE-2026-54464MEDIUMwebsocket-driver: Resource limit bypass via message compressionEPSS 0.4%