CVE-2026-54463: websocket-driver DOS Vulnerability

CVE-2026-54463 Overview

CVE-2026-54463 is a resource exhaustion vulnerability in websocket-driver, a Ruby WebSocket protocol handler with pluggable I/O. Versions prior to 0.8.1 fail to bound the length header used by draft versions of the WebSocket protocol. A remote attacker can transmit an indefinite sequence of bytes with the high bit set (0x80 or higher), which the parser accumulates into an ever-growing Ruby integer. This behavior forces the peer process to allocate unbounded memory until it exhausts host resources. The issue is fixed in version 0.8.1 and is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A network-reachable attacker can exhaust memory on any Ruby process using a vulnerable websocket-driver version, producing a denial-of-service condition against the host.

Affected Products

websocket-driver-ruby versions prior to 0.8.1
Ruby applications and frameworks depending on vulnerable websocket-driver releases (including Faye-based stacks)
Servers and clients negotiating draft-75 or draft-76 WebSocket handshakes

Discovery Timeline

2026-07-17 - CVE-2026-54463 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54463

Vulnerability Analysis

The defect resides in the draft-75/76 framing logic of websocket-driver. The draft protocol encodes frame lengths as a variable-length sequence of bytes where the high bit signals continuation. The parser multiplies the accumulator by 128 and adds the low seven bits of each incoming byte. The implementation applies no upper bound to this accumulator, and Ruby integers grow arbitrarily large by design.

An attacker who controls either side of the WebSocket connection streams a continuous run of bytes with the high bit set. Each byte forces the peer to allocate additional memory for the growing @length integer. The process consumes memory until the operating system terminates it or the host becomes unresponsive. Exploitation requires no authentication and no user interaction over the network.

Root Cause

The length-header parser in lib/websocket/driver/draft75.rb accepts unbounded input and stores the accumulated value in a Ruby Integer, which has no fixed width. Absent a maximum-length check, the loop continues while the attacker sends continuation bytes, aligning with [CWE-770].

Attack Vector

A remote unauthenticated attacker opens a WebSocket connection to a vulnerable server, negotiates a draft-75 or draft-76 handshake, then streams bytes such as 0x80 indefinitely. The vulnerable peer buffers the growing length value and allocates memory without limit. A malicious server can trigger the same failure against a vulnerable client.

ruby

# Patch applied in lib/websocket/driver/draft75.rb
when 1 then
  @length = (octet & 0x7F) + 128 * @length
  return close if @length > @max_length

  if @closing and @length.zero?
    return close

Source: GitHub commit d0141f0

The patch closes the connection when the parsed length exceeds a configured @max_length, terminating the resource-exhaustion loop before memory is exhausted.

Detection Methods for CVE-2026-54463

Indicators of Compromise

Sustained memory growth in Ruby processes hosting WebSocket endpoints without corresponding request volume
WebSocket handshakes negotiating draft-75 or draft-76 rather than RFC 6455
Long-lived TCP connections transmitting continuous streams of bytes at or above 0x80 on the WebSocket data channel
OOM-killer entries in system logs correlated with active WebSocket sessions

Detection Strategies

Inventory Ruby applications and inspect Gemfile.lock for websocket-driver versions below 0.8.1
Instrument WebSocket endpoints to log negotiated protocol drafts and flag draft-75/76 upgrades
Alert on abnormal RSS growth of application workers correlated with active WebSocket sessions

Monitoring Recommendations

Track per-process memory metrics for Ruby application servers (Puma, Passenger, Thin) and alert on rapid RSS increases
Capture and review WebSocket frame lengths at proxy layers such as NGINX or HAProxy for anomalously large declared payloads
Aggregate OOM-kill events in a central log store and correlate with WebSocket connection identifiers

How to Mitigate CVE-2026-54463

Immediate Actions Required

Upgrade websocket-driver to version 0.8.1 or later across all Ruby applications and container images
Rebuild and redeploy dependent gems such as faye-websocket after refreshing the dependency lockfile
Restart long-running Ruby processes to ensure the patched library is loaded into memory

Patch Information

The fix is committed in d0141f0 and released in websocket-driver 0.8.1. Details are published in GitHub Security Advisory GHSA-ghhp-3qvg-889p. The patch enforces a @max_length bound during draft-75/76 length parsing and closes the connection when exceeded.

Workarounds

Disable draft-75 and draft-76 protocol support at the application or proxy layer where feasible, allowing only RFC 6455 WebSocket handshakes
Enforce per-connection memory and request-size limits at a reverse proxy in front of Ruby application servers
Apply operating-system-level cgroup memory limits to Ruby worker processes to contain the blast radius of an in-progress attack

bash

# Update the dependency and verify the installed version
bundle update websocket-driver
bundle list | grep websocket-driver
# Expected: websocket-driver (0.8.1) or newer