CVE-2026-54465: websocket-driver DoS Vulnerability

CVE-2026-54465 Overview

CVE-2026-54465 is a resource exhaustion vulnerability in websocket-driver, a Ruby WebSocket protocol handler with pluggable I/O. Versions prior to 0.8.1 fail to enforce a limit on the size of incoming HTTP request or response headers. A remote peer can send a single connection with a never-ending list of HTTP headers, forcing the receiving process to buffer them until it exhausts available memory. The flaw affects both server implementations built with WebSocket::Driver.server() and clients that parse peer responses. The maintainers assigned this issue to [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A single unauthenticated network connection can exhaust process memory and crash WebSocket servers or clients, resulting in denial of service.

Affected Products

websocket-driver-ruby versions prior to 0.8.1
Ruby WebSocket servers built on WebSocket::Driver.server()
Ruby applications using websocket-driver as a WebSocket client

Discovery Timeline

2026-07-17 - CVE-2026-54465 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54465

Vulnerability Analysis

The websocket-driver library parses the HTTP handshake that precedes a WebSocket upgrade. During parsing, header lines are appended to an internal buffer until the CRLF terminator sequence marks the end of the header block. The parser enforces a per-line ceiling but does not enforce a ceiling on the cumulative size of all headers received.

A remote peer can hold the connection open and stream an unbounded sequence of syntactically valid header lines. Each line remains in memory while the handshake stays incomplete. Memory pressure grows linearly with the volume of headers, eventually triggering allocator failure or invocation of the operating system out-of-memory killer.

The vulnerability requires no authentication and can be triggered pre-handshake, before any application logic runs. Exploitation from a single low-bandwidth connection is sufficient to degrade or crash the host process.

Root Cause

The module WebSocket::HTTP::Headers defined MAX_LINE_LENGTH = 4096 to cap the length of any single header line but did not track the aggregate size of the header block. Header parsing continued until the CR/LF end-of-headers sequence was observed, allowing an attacker to defer that sequence indefinitely.

Attack Vector

An attacker opens a TCP connection to a WebSocket endpoint and issues a partial HTTP handshake. The attacker then streams header lines below the 4096-byte per-line ceiling and never sends the terminating blank line. The receiver retains every header in memory while it waits for the handshake to complete.

ruby

// Security patch in lib/websocket/http/headers.rb
   module HTTP
 
     module Headers
-      MAX_LINE_LENGTH = 4096
+      MAX_REQUEST_SIZE = 32768
       CR = 0x0D
       LF = 0x0A

Source: GitHub commit 17b569f. The patch replaces the per-line ceiling with a 32 KB cap on the total request line and headers, terminating parsing once the aggregate size is exceeded.

Detection Methods for CVE-2026-54465

Indicators of Compromise

Sustained memory growth in Ruby processes that terminate an HTTP handshake with Upgrade: websocket
TCP connections to WebSocket endpoints that remain in the handshake phase for extended periods without completing the upgrade
Process crashes or OOM-killer events on hosts running faye, faye-websocket, or other gems that depend on websocket-driver

Detection Strategies

Inventory Ruby applications and their Gemfile.lock entries to identify installs of websocket-driver earlier than 0.8.1
Instrument the HTTP handshake path to log connections whose header size exceeds 32 KB or whose handshake exceeds a reasonable time budget
Alert on repeated process restarts of WebSocket workers, which often indicate memory exhaustion crashes

Monitoring Recommendations

Track resident set size (RSS) of WebSocket worker processes and alert on abrupt growth curves
Monitor connection duration distributions on WebSocket ports and flag long-lived pre-handshake sessions
Correlate remote source IPs producing oversized or slow handshakes for potential blocklisting

How to Mitigate CVE-2026-54465

Immediate Actions Required

Upgrade websocket-driver to version 0.8.1 or later across all Ruby application dependencies
Restart any long-running WebSocket workers after the upgrade to load the patched code
Place WebSocket endpoints behind a reverse proxy that enforces header size and request timeout limits

Patch Information

The fix is released in websocket-driver 0.8.1. It introduces MAX_REQUEST_SIZE = 32768, bounding the total HTTP request line and headers to 32 KB. Details are available in the GitHub Security Advisory GHSA-8j3g-f24p-4mpw and the upstream commit.

Workarounds

Front WebSocket services with a proxy such as NGINX or HAProxy that caps large_client_header_buffers and enforces client_header_timeout
Apply application-layer rate limits and idle-connection timeouts to WebSocket handshake endpoints
Restrict WebSocket ingress to authenticated sources where feasible until the upgrade is deployed

bash

# NGINX configuration example limiting header size and handshake time
http {
    client_header_buffer_size 4k;
    large_client_header_buffers 4 8k;
    client_header_timeout 10s;

    server {
        location /ws {
            proxy_pass http://ruby_upstream;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }
}