CVE-2026-61666 — websocket-driver: Denial of service via malformed Host header
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http…
Published: 2026-08-17 · CVSS: 8.9 · CVSS 4.0
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7