CVE-2026-61666

HighCVSS 8.9

Published: 17/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Summary

websocket-driver before version 0.8.2 has a vulnerability in WebSocket::Driver.server() that passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.

Risk Assessment

A remote attacker can crash the WebSocket server, leading to denial of service (DoS).

Recommendation

Upgrade websocket-driver to version 0.8.2 or later.

Original NVD description (English source)

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.