CVE-2026-54464: WebSocket Permessage-Deflate DoS Vulnerability

CVE-2026-54464 Overview

CVE-2026-54464 affects the websocket-driver-ruby library when used with the permessage-deflate extension. The library enforces the maximum message size against the compressed frame length header instead of the decompressed payload size. A remote attacker can send small, highly compressed WebSocket frames that expand into payloads far larger than the configured limit. This allows WebSocket servers and clients built on the library to accept oversized messages and consume unintended memory and CPU resources. The issue is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling] and was reported by Pranjali Thakur of the DepthFirst Security Research Team.

Critical Impact
Attackers can bypass configured message size limits through compression, driving resource exhaustion on WebSocket endpoints.

Affected Products

websocket-driver-ruby versions prior to 0.8.1
Ruby applications using websocket-driver with the permessage-deflate extension enabled
Faye and Rack-based WebSocket servers and clients that depend on websocket-driver-ruby

Discovery Timeline

2026-07-17 - CVE-2026-54464 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54464

Vulnerability Analysis

The websocket-driver-ruby library implements the WebSocket protocol (RFC 6455) and negotiates the permessage-deflate extension defined in RFC 7692. When a peer sends a compressed frame, the library reads the frame's declared payload length from the frame header. The library compares this compressed length to the configured max_length value before invoking the decompression pipeline.

The check operates on the wire size rather than the inflated size. An attacker who controls the sender can craft frames where the compressed length is well below max_length but the decompressed payload is orders of magnitude larger. This produces a compression amplification primitive against any endpoint that accepts inbound WebSocket messages.

Root Cause

The root cause is a missing post-decompression bounds check in the frame reassembly path inside lib/websocket/driver/hybi.rb. Message length validation is executed against the raw frame data before the permessage-deflate extension processes the payload. Once inflation completes, the resulting buffer is passed to the application without a second comparison against max_length.

Attack Vector

An unauthenticated remote attacker establishes a WebSocket connection that negotiates the permessage-deflate extension. The attacker sends a highly compressible payload, for example a long run of repeated bytes, packaged into a compressed frame whose header length is under the configured limit. The library accepts the frame, decompresses it, and hands the oversized buffer to the application. Repeated messages amplify memory pressure and can degrade or crash the service.

ruby

# Security patch in lib/websocket/driver/hybi.rb (v0.8.1)
# Enforces max_length against the decompressed payload size

        payload = message.data

        if payload.bytesize > @max_length
          return fail(:too_large, 'WebSocket frame length too large')
        end

        case message.opcode
          when OPCODES[:text] then
            payload = Driver.encode(payload, Encoding::UTF_8)

Source: GitHub commit fa86417. The fix adds a bounds check after incoming extensions run, so the enforced size reflects the true payload delivered to the application.

Detection Methods for CVE-2026-54464

Indicators of Compromise

Sudden growth in resident memory of Ruby processes that handle WebSocket traffic
WebSocket sessions negotiating permessage-deflate with unusually small compressed frames producing large application-side buffers
Application logs showing message handlers processing payloads larger than the documented max_length

Detection Strategies

Inspect the Sec-WebSocket-Extensions header in handshake logs and correlate sessions using permessage-deflate with anomalous inbound byte counts
Instrument the WebSocket handler to log both compressed frame length and decompressed payload length, and alert when the ratio exceeds a threshold such as 100:1
Compare process-level memory metrics against baselines for services running vulnerable versions of websocket-driver-ruby

Monitoring Recommendations

Track dependency inventories for Ruby projects and flag any resolved version of websocket-driver below 0.8.1
Emit metrics for message size, decompression ratio, and dropped frames at the WebSocket layer and forward them to a central log platform
Set rate and payload-size thresholds on upstream proxies or load balancers that terminate WebSocket traffic

How to Mitigate CVE-2026-54464

Immediate Actions Required

Upgrade websocket-driver to version 0.8.1 or later in every Ruby application and dependency lockfile
Rebuild and redeploy any Faye, Rack, or ActionCable-adjacent services that bundle the affected gem
Audit application configuration to confirm max_length is set to a value appropriate for the workload

Patch Information

The maintainers fixed the issue in websocket-driver-ruby 0.8.1 by validating payload size after the permessage-deflate extension decompresses the message. Details are available in the GitHub Security Advisory GHSA-33ph-fccm-39pj and the patch commit.

Workarounds

No vendor-supplied workarounds exist; upgrading to 0.8.1 is required
As a temporary risk reduction, disable the permessage-deflate extension on servers and clients until the patched gem is deployed
Enforce message-size and connection-rate limits at an upstream reverse proxy that terminates or inspects WebSocket traffic

bash

# Update the gem to the patched release
bundle update websocket-driver --conservative

# Verify the resolved version is 0.8.1 or later
bundle info websocket-driver | grep -i version