CVE-2026-61666: 
Ruby vulnerability analysis and mitigation

CVE-2026-61666 is a Denial of Service vulnerability in the websocket-driver Ruby gem (faye/websocket-driver-ruby) caused by an uncaught URI::InvalidURIError exception when processing a malformed Host header. It affects all versions of the websocket-driver RubyGems package prior to 0.8.2, and only impacts deployments using the WebSocket::Driver.server() method to build a WebSocket server on top of a TCP server. The vulnerability was discovered by Pranjali Thakur of the DepthFirst Security Research Team, first published on June 23, 2026, and added to the GitHub Advisory Database on July 21, 2026. It carries a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory).

The root cause is an uncaught exception (CWE-248) in the HTTP request parser within lib/websocket/http/request.rb. When the server-side driver processes an incoming WebSocket upgrade request, it calls URI.parse("http://#{host}") on the value of the Host header to extract SERVER_NAME and SERVER_PORT. If the Host header contains a value that is not a valid host[:port] string, Ruby's URI.parse raises a URI::InvalidURIError that is not rescued, propagating up the call stack and potentially crashing the server process if the application does not itself catch exceptions from the parse() method. The fix in commit 7d6fd87 wraps the URI parsing logic in a rescue URI::InvalidURIError block that transitions the driver into an error state, rejecting the malformed request (GitHub Advisory, Patch Commit).

Successful exploitation results in a crash of the server process, causing a complete loss of availability for the affected WebSocket service. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized modification. If the WebSocket server runs as a shared or critical process, a crash could disrupt all connected clients and dependent services, though lateral movement or data exfiltration are not possible through this vulnerability alone (GitHub Advisory).

1. Reconnaissance: Identify a target server running a Ruby application that uses the websocket-driver gem (versions < 0.8.2) with WebSocket::Driver.server() to handle WebSocket connections over a raw TCP socket.
2. Craft malicious request: Construct an HTTP WebSocket upgrade request containing a Host header with an invalid value that cannot be parsed as a host[:port] string (e.g., a value with illegal URI characters such as Host: [invalid@@host).
3. Send the request: Transmit the crafted HTTP request to the target server's TCP port where the WebSocket server is listening, without any authentication or prior session establishment.
4. Trigger crash: The server's request parser calls URI.parse("http://[invalid@@host"), which raises URI::InvalidURIError. Since this exception is not caught in versions < 0.8.2, it propagates and crashes the server process, taking down the WebSocket service (GitHub Advisory, Patch Commit).

• Logs: Ruby application logs or server error logs showing unhandled URI::InvalidURIError exceptions originating from lib/websocket/http/request.rb or the parse() method stack trace.
• Network: Incoming TCP connections to the WebSocket port containing HTTP upgrade requests with syntactically invalid or malformed Host header values (e.g., containing illegal URI characters).
• Process: Unexpected termination or restart of the Ruby server process, particularly correlated with incoming WebSocket connection attempts from external clients.

Upgrade the websocket-driver RubyGems package to version 0.8.2 or later, which patches the issue by catching URI::InvalidURIError in the request parser and entering an error state for malformed Host headers. No configuration-based workarounds are available. As a temporary measure until upgrading is possible, applications can wrap calls to the parse() method in a rescue block to catch and handle URI::InvalidURIError themselves, preventing the exception from crashing the server process (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by Pranjali Thakur of the DepthFirst Security Research Team. The fix was authored by the library maintainer (jcoglan) and published as a security advisory on June 23, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been observed (GitHub Advisory).