WebSocket Protocol Handler Vulnerability in Faye Software's Implementation
CVE-2026-61666

8.9HIGH

Key Information:

Vendor

Faye

Status
Websocket-driver-ruby
Vendor
CVE Published:
17 August 2026

What is CVE-2026-61666?

The websocket-driver, a WebSocket protocol handler created by Faye Software, suffers from an improper input validation vulnerability prior to version 0.8.2. The issue arises in the WebSocket::Driver.server() method, which does not properly handle malformed Host headers. When such a header is passed to the URI.parse function in lib/websocket/http/request.rb, it leads to an unhandled URI::InvalidURIError, potentially causing a remote client to crash a TCP-backed WebSocket server. This vulnerability poses a risk to applications that do not implement error handling for the parsing process. The issue has been addressed and fixed in version 0.8.2.

Affected Version(s)

websocket-driver-ruby < 0.8.2

References

https://github.com/faye/websocket-driver-ruby/security/ad...
x_refsource_CONFIRM
https://github.com/faye/websocket-driver-ruby/commit/7d6f...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.