Bug 2510734 (CVE-2026-61666)

Summary:	CVE-2026-61666 websocket-driver: github.com/faye/websocket-driver-ruby: websocket-driver: Denial of Service via malformed Host header
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akostadi, amasferr, anthomas, dmayorov, ehelms, eshamard, ggainey, jlledo, jpasqual, juwatts, jvasik, kaycoth, mdellweg, mhulan, nmoumoul, osousa, pantinor, pcreech, rblanco, rchan, smallamp, tmalecek, tsedmik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in websocket-driver. A remote attacker can exploit this vulnerability by sending a malformed Host header that does not conform to a valid host[:port] string. This action triggers an uncaught exception, leading to a Denial of Service (DoS) by crashing the WebSocket server and making it unavailable to legitimate users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-03 18:43:39 UTC

A denial of service vulnerability exists in websocket-driver for Ruby. A client can crash a WebSocket server by sending a Host header that is not a valid host[:port] string, which triggers an uncaught URI::InvalidURIError exception.

Affected versions: websocket-driver < 0.8.2 (RubyGems).
Fixed in websocket-driver 0.8.2, where the parser now catches URI::InvalidURIError and enters an error state when the Host header is malformed, preventing connection establishment.

No known workarounds exist.

Discovered by Pranjali Thakur of DepthFirst Security Research Team.