Cloudanix VulnDB

CVE-2026-61666

None

CVSS

—

EPSS

0.4%

Published

Aug 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A remote attacker can send a specially crafted network request that crashes WebSocket servers, interrupting service until the server is restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Malformed Host header in WebSocket upgrade request reaches URI.parse in lib/websocket/http/request.rb inside WebSocket::Driver.server() without an enclosing rescue for URI::InvalidURIError, causing an unhandled exception that terminates the TCP server process.

Why it matters to the business

Remote unauthenticated clients can repeatedly crash WebSocket servers, producing service outages for any application that exposes a TCP-backed WebSocket endpoint and does not catch the parse error.

How an attack unfolds

An attacker crafts a WebSocket handshake request containing an invalid Host header value, sends it to a server using websocket-driver prior to 0.8.2, and triggers the uncaught URI::InvalidURIError that terminates the listening process.

How to fix it

Upgrade websocket-driver to version 0.8.2 or later. Applications should also wrap calls that receive external headers in rescue blocks for URI::InvalidURIError.

How to confirm the fix worked

Confirm the installed gem version is at least 0.8.2; replay a malformed-Host handshake against a test instance and verify the process no longer terminates.

Typical attack path

  1. Identify a TCP WebSocket endpoint using the vulnerable websocket-driver library
  2. Send a single HTTP upgrade request with a malformed Host header
  3. Observe unhandled URI::InvalidURIError and process termination
  4. Repeat to sustain denial of service

How to detect it

Search application and system logs for uncaught URI::InvalidURIError exceptions originating from lib/websocket/http/request.rb around the time of service restarts or crashes; correlate with incoming WebSocket upgrade requests containing unusual Host header values.

  • URI::InvalidURIError
  • lib/websocket/http/request.rb
  • WebSocket::Driver.server

What your security team should do

  • Immediately upgrade all instances of websocket-driver to 0.8.2
  • Add input validation or error handling around WebSocket handshake processing
  • Monitor application logs for URI::InvalidURIError entries
  • Review downstream dependents for direct or transitive use of the library

The record

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities