---
id: "CVE-2026-61666"
kind: "vulnerability"
aliases: ["CVE-2026-61666", "GHSA-2x63-gw47-w4mm"]
title: "websocket-driver-ruby: Denial of service via malformed Host header"
severity: "high"
cvss: 8.9
epss: 0.00445
exploited: false
status: "open"
category: "package"
products: [{"name": "websocket-driver", "fixed": ["0.8.2"], "affected": "< 0.8.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-248", "package", "ruby", "self-hosted", "websocket"]
not_affected_if: ["client-only", "errors-caught-in-parse", "no-driver-server"]
published_at: "2026-07-21T18:34:42+00:00"
first_seen_at: "2026-11-02T21:11:48+00:00"
updated_at: "2026-11-02T21:35:41+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-2x63-gw47-w4mm", "first_seen_at": "2026-11-02T21:11:48+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61666", "first_seen_at": "2026-11-02T21:35:41+00:00"}]
---

# websocket-driver-ruby: Denial of service via malformed Host header

The websocket-driver Ruby gem raises an uncaught URI::InvalidURIError when a client sends a Host header that is not a valid host[:port] string. An unauthenticated remote client can crash the server process when the application does not catch the error from parse().

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:websocket-driver affected < 0.8.2 fixed 0.8.2

## How to check

- Check the locked gem version in `Gemfile.lock` for `websocket-driver`
- Look for calls to `WebSocket::Driver.server()` in your code
- Confirm whether your application rescues errors raised from the driver's `parse()` method

## Fix

- `websocket-driver` (rubygems) upgrade to `0.8.2` or later; affected versions are below `0.8.2`

## Timeline

- 2026-11-02T21:11:48+00:00 ghsa https://github.com/advisories/GHSA-2x63-gw47-w4mm
- 2026-11-02T21:35:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61666

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/faye/websocket-driver-ruby/security-advisories/GHSA-2x63-gw47-w4mm
- [advisory] Maintainer's advisory: github.com https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-2x63-gw47-w4mm
- [fix] Patch: github.com https://github.com/faye/websocket-driver-ruby/commit/7d6fd87759a2fdc83590d3b49ffa661dc53fa128

## From the sources

### Impact

If this library is used to implement a WebSocket server on top of a TCP server, by using the `WebSocket::Driver.server()` method, then a client can cause the server to crash by sending a `Host` header that is not a valid `host[:port]` string. When this happens, a `URI::InvalidURIError` exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the `parse()` method itself.

### Patches

The issue has been patched in version 0.8.2 by making the request parser catch `URI::InvalidURIError` and enter an error state if the `Host` header is malformed. This means the request is considered invalid and should not establish a WebSocket connection.

### Workarounds

No known workarounds exist.

### Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_