CVE-2026-61666highCWE-248

CVE-2026-61666: falha de alta gravidade em faye websocket-driver-ruby

websocket-driver: Denial of service via malformed Host header

Publicada em

Seguir esta CVE+ Monitorar websocket-driver-ruby+ Monitorar ruby-websocket-driver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.9epss 0.4%
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Produtos afetados
faye · websocket-driver-ruby
CVEs relacionadas — faye websocket-driver-ruby

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54465MEDIUMwebsocket-driver: Memory exhaustion in HTTP header parserEPSS 0.5%CVE-2026-54463MEDIUMwebsocket-driver: Memory exhaustion via abuse of protocol length headersEPSS 0.5%CVE-2026-54464MEDIUMwebsocket-driver: Resource limit bypass via message compressionEPSS 0.4%