Denial of Service in websocket-driver-ruby via Malformed Host Header (CVE-2026-61666)

A high-severity denial of service (DoS) vulnerability, tracked as CVE-2026-61666, has been identified in the websocket-driver-ruby library, specifically affecting versions prior to 0.8.2. This vulnerability impacts applications that use the library to implement a WebSocket server via the WebSocket::Driver.server() method. An unauthenticated remote attacker can exploit this flaw by sending an HTTP request containing a malformed Host header, one that does not conform to the standard host[:port] string format. This malformed header triggers a URI::InvalidURIError exception within the library's parsing logic. If the vulnerable application does not explicitly catch this specific exception, the unhandled error will cause the server process to crash, leading to a complete denial of service for the affected WebSocket server. The issue has been patched in version 0.8.2, which includes error handling for invalid Host headers.

Attack Chain

1. An attacker identifies a target application running a WebSocket server using the websocket-driver library (versions prior to 0.8.2) through the WebSocket::Driver.server() method.
2. The attacker crafts a standard HTTP GET request intended for the WebSocket server.
3. The crafted request includes a Host header that is malformed, specifically containing characters or structures that violate the host[:port] format (e.g., Host: invalid host.com).
4. The websocket-driver library's internal parsing mechanisms attempt to process the malformed Host header received from the attacker's request.
5. During the parsing of the malformed Host header, the library encounters an invalid URI string, which raises a URI::InvalidURIError exception.
6. Because the vulnerable application utilizing the websocket-driver library does not have specific error handling in place to catch the URI::InvalidURIError exception from the parse() method, the exception propagates unhandled.
7. The unhandled exception causes the entire WebSocket server process to terminate abruptly, leading to a crash and making the service unavailable to legitimate users.
8. The attacker successfully achieves a denial of service, rendering the WebSocket server inoperable until manually restarted.

Impact

The successful exploitation of CVE-2026-61666 results in a denial of service (DoS) for affected WebSocket servers. When a malformed Host header is processed, a URI::InvalidURIError is raised. If the application does not explicitly catch this error, the server process will crash, making the WebSocket service completely unavailable. This can lead to significant downtime for any services relying on the WebSocket communication, disrupting real-time functionalities, data synchronization, or interactive applications. There are no specific victim numbers or targeted sectors mentioned, but any organization using the vulnerable websocket-driver gem in a server capacity is at risk.

Recommendation

• Patch all instances of websocket-driver to version 0.8.2 or later immediately to mitigate CVE-2026-61666.
• Deploy the provided Sigma rule to your SIEM to detect attempts at exploiting CVE-2026-61666 by identifying malformed Host headers.
• Ensure webserver logs capture full HTTP request headers, especially the Host header, to enable detection of the patterns specified in the Sigma rule.