CVE-2026-54464
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The WebSocket library used with the permessage-deflate extension can accept messages larger than the configured maximum size. The limit is checked against the message frames' length headers, which give the size of compressed data, not the size after decompression.
Risk Assessment
The organization may experience excessive resource usage as applications can accept larger messages than expected, potentially leading to system overload.
Recommendation
Immediately upgrade the library to version 0.8.1, which includes a fix that checks message length after processing by extensions.
Other vulnerabilities in websocket-driver
See all- CVE-2026-61666High
websocket-driver before version 0.8.2 has a vulnerability in WebSocket::Driver.server() that passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.
- CVE-2026-54490Medium
The websocket-driver library prior to 0.7.5, when used with the permessage-deflate extension, checks the message size limit against compressed data, not after decompression. This allows accepting messages larger than the configured maximum.
- CVE-2026-54466High
The websocket-driver library before version 0.7.5 incorrectly handles the frame length in the WebSocket protocol. By sending an indefinite sequence of bytes with the high bit set, an attacker can cause the server to parse these bytes as an ever-growing integer, leading to precision loss and incorrect payload parsing.
- CVE-2026-54465High
websocket-driver before version 0.8.1 is vulnerable to an attack where sending an HTTP request with an endless list of headers causes unbounded memory consumption in the receiving process.
- CVE-2026-54463High
In the websocket-driver library before version 0.8.1, the length header in the WebSocket protocol allows encoding an arbitrarily large integer as bytes with the high bit set. A server or client can send an indefinite sequence of 0x80 or higher bytes that are parsed into an ever-growing Ruby integer.
Original NVD description (English source)
### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. ### Patches The issue has been patched in version 0.8.1, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version. ### Workarounds No known workarounds exist. ### Acknowledgements This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.